Rapid7 Vulnerability & Exploit Database

Pulse Secure Pulse Connect Secure: Remote desktop protocol (RDP) client restriction bypass issue (SA40166)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

Pulse Secure Pulse Connect Secure: Remote desktop protocol (RDP) client restriction bypass issue (SA40166)

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
02/26/2016
Created
10/28/2020
Added
10/28/2020
Modified
02/15/2024

Description

A security issue was discovered in the PCS Terminal Services Remote Desktop Protocol (RDP) client session restrictions feature. By exploiting this issue a malicious authenticated user could bypass security controls applied against their terminal services session. This issue is only exploitable by users who have a valid authenticated session to the PCS device as well as authenticating to the backend terminal services server.

Solution(s)

  • pulse-secure-pulse-connect-secure-upgrade-8_1r8
  • pulse-secure-pulse-connect-secure-upgrade-8_2r1_1

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;