CVEvulnerability

CVE-2019-11539

7.2 HIGH Known exploited Published 2019-04-26 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability — Ivanti Pulse Connect Secure and Pulse Policy Secure

Ivanti Pulse Connect Secure and Policy Secure allows an authenticated attacker from the admin web interface to inject and execute commands.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2019-11539
Status
Analyzed
Published
2019-04-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected])
8.0 HIGH — CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-78

Description

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.

Affected configurations

• ivanti connect secure 8.1 • ivanti connect secure 8.2 • ivanti connect secure 8.3 • ivanti connect secure 9.0 • ivanti policy secure 9.0 • pulsesecure pulse policy secure 5.1r1.0 • pulsesecure pulse policy secure 5.1r1.1 • pulsesecure pulse policy secure 5.1r2.0 • pulsesecure pulse policy secure 5.1r2.1 • pulsesecure pulse policy secure 5.1r3.0 • pulsesecure pulse policy secure 5.1r3.2 • pulsesecure pulse policy secure 5.1r4.0 • pulsesecure pulse policy secure 5.1r5.0 • pulsesecure pulse policy secure 5.1r6.0 • pulsesecure pulse policy secure 5.1r7.0 • pulsesecure pulse policy secure 5.1r8.0 • pulsesecure pulse policy secure 5.1r9.0 • pulsesecure pulse policy secure 5.1r9.1 • pulsesecure pulse policy secure 5.1r10.0 • pulsesecure pulse policy secure 5.1r11.0 • pulsesecure pulse policy secure 5.1r11.1 • pulsesecure pulse policy secure 5.1r12.0 • pulsesecure pulse policy secure 5.1r12.1 • pulsesecure pulse policy secure 5.1r13.0 • pulsesecure pulse policy secure 5.1r14.0 • pulsesecure pulse policy secure 5.2r1.0 • pulsesecure pulse policy secure 5.2r2.0 • pulsesecure pulse policy secure 5.2r3.0 • pulsesecure pulse policy secure 5.2r3.2 • pulsesecure pulse policy secure 5.2r4.0 • pulsesecure pulse policy secure 5.2r5.0 • pulsesecure pulse policy secure 5.2r6.0 • pulsesecure pulse policy secure 5.2r7.0 • pulsesecure pulse policy secure 5.2r7.1 • pulsesecure pulse policy secure 5.2r8.0 • pulsesecure pulse policy secure 5.2r9.0 • pulsesecure pulse policy secure 5.2r9.1 • pulsesecure pulse policy secure 5.2r10.0 • pulsesecure pulse policy secure 5.2r11.0 • pulsesecure pulse policy secure 5.2rx • pulsesecure pulse policy secure 5.3r1.0 • pulsesecure pulse policy secure 5.3r1.1 • pulsesecure pulse policy secure 5.3r2.0 • pulsesecure pulse policy secure 5.3r3.0 • pulsesecure pulse policy secure 5.3r3.1 • pulsesecure pulse policy secure 5.3r4.0 • pulsesecure pulse policy secure 5.3r4.1 • pulsesecure pulse policy secure 5.3r5.0 • pulsesecure pulse policy secure 5.3r5.1 • pulsesecure pulse policy secure 5.3r5.2 • pulsesecure pulse policy secure 5.3r6.0 • pulsesecure pulse policy secure 5.3r7.0 • pulsesecure pulse policy secure 5.3r8.0 • pulsesecure pulse policy secure 5.3r8.1 • pulsesecure pulse policy secure 5.3r8.2 • pulsesecure pulse policy secure 5.3r9.0 • pulsesecure pulse policy secure 5.3r10. • pulsesecure pulse policy secure 5.3r11.0 • pulsesecure pulse policy secure 5.3r12.0 • pulsesecure pulse policy secure 5.3rx … and 11 more

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References