Skip to main content
IMMUNITYSEC

CVE-2020-8218

7.2
HIGH
CVSS 3.1
EPSS 32.3% · 98th pctCISA KEV · Exploited in the wildCWE-94
2020-07-30•Updated 2025-10-21•KEV 2022-03-07
CISA Known Exploited Vulnerabilities

Pulse Connect Secure Code Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2022-03-07
Remediation due
2022-09-07

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2020-8218

Description

A code injection vulnerability exists in Pulse Connect Secure <9.1R8 that allows an attacker to crafted a URI to perform an arbitrary code execution via the admin web interface.

Severity

CVSS 3.1 · CISA7.2 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableno
Technical impacttotal

Affected Products

VendorProductAffected versions
-Pulse Connect Secure
Fixed in 9.1R8

References

2 Links

Record Details

Published
2020-07-30
Last updated
2025-10-21
Assigner (CNA)
hackerone
Credited to
-

More from Ivanti

All Ivanti CVEs→
CVE-2019-115109.9 CRITICAL

Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

KEVEPSS 100.0%2019-05-08
CVE-2020-82607.2 HIGH

Ivanti Pulse Connect Secure Code Execution Vulnerability

KEVEPSS 96.5%2020-10-28
CVE-2020-82437.2 HIGH

Ivanti Pulse Connect Secure Code Execution Vulnerability

KEVEPSS 90.8%2020-09-29
CVE-2021-2289310 CRITICAL

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

KEVEPSS 47.2%2021-04-23

Related

Tool categories

Application Security ToolsPenetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.