CVE-2020-8206

An improper authentication vulnerability exists in Pulse Connect Secure <9.1RB that allows an attacker with a users primary credentials to bypass the Google TOTP.

Published: Jul 30, 2020
Updated: Apr 14, 2023
CVE: CVE-2020-8206
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.1
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
pulsesecure / pulse_connect_secure	-	9.0.x
pulsesecure / pulse_policy_secure	-	9.0.x
ivanti / policy_secure	9.1-r4.2	9.1-r4.2.x
ivanti / policy_secure	9.1-r4.1	9.1-r4.1.x
ivanti / policy_secure	9.1-r3.1	9.1-r3.1.x
ivanti / policy_secure	9.1-r1	9.1-r1.x
ivanti / policy_secure	9.1-r2	9.1-r2.x
ivanti / policy_secure	9.1-r3	9.1-r3.x
ivanti / policy_secure	9.1-r4	9.1-r4.x
ivanti / policy_secure	9.1-r5	9.1-r5.x
ivanti / policy_secure	9.1-r6	9.1-r6.x
ivanti / policy_secure	9.1-r7	9.1-r7.x
ivanti / policy_secure	9.1	9.1.x
ivanti / connect_secure	9.1-r1	9.1-r1.x
ivanti / connect_secure	9.1-r2	9.1-r2.x
ivanti / connect_secure	9.1-r3	9.1-r3.x
ivanti / connect_secure	9.1-r4	9.1-r4.x
ivanti / connect_secure	9.1-r4.1	9.1-r4.1.x
ivanti / connect_secure	9.1-r4.2	9.1-r4.2.x
ivanti / connect_secure	9.1-r4.3	9.1-r4.3.x
ivanti / connect_secure	9.1-r5	9.1-r5.x
ivanti / connect_secure	9.1-r6	9.1-r6.x
ivanti / connect_secure	9.1-r7	9.1-r7.x
ivanti / connect_secure	9.1	9.1.x

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516

Vulnerability Database

289,784

CVE-2020-8206