PT-2020-12696
CVE-2020-11580
·
Published
2020-04-06
·
Updated
2021-09-16
Description by
CVSS 3.1
9.1
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Pulse Secure Pulse Connect Secure (PCS) versions prior to 2020-04-06
Description
An issue was discovered where the applet in tncc.jar accepts an arbitrary SSL certificate when a Host Checker policy is enforced on macOS, Linux, and Solaris clients.
Recommendations
For Pulse Secure Pulse Connect Secure (PCS) versions prior to 2020-04-06, consider disabling the Host Checker policy as a temporary workaround until a patch is available. Restrict access to the tncc.jar applet to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾