An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/2 Header. This vulnerability is resolved in 21.1, 20.3R1, 20.2R1, 20.1R2, 19.2R4, and 18.2R3.
References
Link | Resource |
---|---|
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790 | Exploit Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Jul 2022, 17:42
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-444 |
24 May 2021, 19:41
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.3:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.3:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:r1:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:19.2:r2:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.2:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:20.1:-:*:*:*:*:*:* cpe:2.3:a:pulsesecure:virtual_traffic_manager:18.2:-:*:*:*:*:*:* |
|
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
CWE | CWE-335 | |
References | (MISC) https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44790 - Exploit, Patch, Vendor Advisory |
Information
Published : 2021-05-14 01:15
Updated : 2024-02-04 21:47
NVD link : CVE-2021-31922
Mitre link : CVE-2021-31922
CVE.ORG link : CVE-2021-31922
JSON object : View
Products Affected
pulsesecure
- virtual_traffic_manager
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')