Vulnerability Description
Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pulsesecure | Pulse Connect Secure | >= 8.1, < 8.1r14 |
References
- http://www.securityfocus.com/bid/104160Third Party AdvisoryVDB Entry
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730Vendor Advisory
- http://www.securityfocus.com/bid/104160Third Party AdvisoryVDB Entry
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43730Vendor Advisory
FAQ
What is CVE-2018-9849?
CVE-2018-9849 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of servi...
How severe is CVE-2018-9849?
CVE-2018-9849 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-9849?
Check the references section above for vendor advisories and patch information. Affected products include: Pulsesecure Pulse Connect Secure.