CVE-2018-20812
high-risk
Published 2019-06-28
An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints.
Do I need to act?
-
0.32% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10
High
NETWORK
/ LOW complexity
Affected Products (20)
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Pulse Secure Desktop Client
Affected Vendors
References (2)
53
/ 100
high-risk
Severity
26/34 · High
Exploitability
1/34 · Minimal
Exposure
26/34 · High