CVE-2020-15352 - An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request

Back Back to CVE browser

HIGH

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request

Published Oct 27, 2020

7.2

HIGH

CVSS 3.1

EPSS 3.20%

Description

An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7349
Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7349		Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601		x_refsource_MISCVendor Advisory