CVE-2019-11510:CVE-2019-11510 is a critical arbitrary file reading vulnerability in Pulse Secure Pulse Connect Secure (PCS) versions 8.2, 8.3, and 9.0, allowing unauthenticated remote attackers to exploit the system via specially crafted URIs.

splash
Back

Description Preview

In Pulse Secure Pulse Connect Secure (PCS) versions 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability. This vulnerability can lead to significant impacts, including unauthorized access to sensitive files, which may compromise the confidentiality, integrity, and availability of the affected systems.

Overview

  • CVE ID: CVE-2019-11510
  • Published Date: May 8, 2019
  • Last Updated: February 3, 2025
  • Severity: Critical (CVSS Base Score: 9.9)
  • Affected Versions:
    • Pulse Connect Secure (PCS) 8.2 before 8.2R12.1
    • Pulse Connect Secure (PCS) 8.3 before 8.3R7.1
    • Pulse Connect Secure (PCS) 9.0 before 9.0R3.4
  • Attack Vector: Network
  • Privileges Required: Low
  • User Interaction: None
  • Impact: High on confidentiality, integrity, and availability.

Remediation

To mitigate the risk associated with CVE-2019-11510, it is recommended that users of Pulse Secure Pulse Connect Secure (PCS) upgrade to the following versions:

  • Upgrade to Pulse Connect Secure (PCS) 8.2R12.1 or later.
  • Upgrade to Pulse Connect Secure (PCS) 8.3R7.1 or later.
  • Upgrade to Pulse Connect Secure (PCS) 9.0R3.4 or later.

Additionally, organizations should implement network security measures, such as firewalls and intrusion detection systems, to monitor and restrict unauthorized access attempts.

References

  1. Pulse Secure Security Advisories
  2. Pulse Secure Advisory SA44101
  3. SecurityFocus BID 108073
  4. SonicWall PSIRT Advisory
  5. Packet Storm Security Advisory
  6. Bad Packets Report on Vulnerable Endpoints
  7. CISA Known Exploited Vulnerabilities Catalog
  8. CERT Vulnerability Note VU#927237

Early Warning

Customers using Armis Early Warning were notified about this vulnerability before it appeared in CISA's Known Exploited Vulnerabilities Catalog, enabling them to assess their exposure and act proactively. Armis offers these examples of CVEs already included in CISA KEV for potential customers. Click here to learn how to receive alerts earlier.

Armis Alert Date
May 8, 2019
CISA KEV Date
Nov 3, 2021
910days early

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Educational Services: Low
    Educational Services
  2. Manufacturing: Low
    Manufacturing
  3. Retail Trade: Low
    Retail Trade
  4. Accommodation & Food Services: Low
    Accommodation & Food Services
  5. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  6. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  7. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  8. Construction: Low
    Construction
  9. Finance and Insurance: Low
    Finance and Insurance
  10. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  11. Information: Low
    Information
  12. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  13. Mining: Low
    Mining
  14. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  16. Public Administration: Low
    Public Administration
  17. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  18. Transportation & Warehousing: Low
    Transportation & Warehousing
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background