CVE-2019-11510 in Pulse Connect Secure
Summary
by MITRE
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/17/2025
The CVE-2019-11510 vulnerability represents a critical arbitrary file reading flaw in Pulse Secure Pulse Connect Secure appliances that affects multiple versions of the software. This vulnerability stems from inadequate input validation within the application's URI handling mechanism, allowing remote attackers to craft malicious requests that can traverse the file system and access sensitive files on the affected systems. The flaw exists in versions 8.2 prior to 8.2R12.1, 8.3 prior to 8.3R7.1, and 9.0 prior to 9.0R3.4, making it a widespread issue across several major release branches of the Pulse Connect Secure platform.
The technical exploitation of this vulnerability occurs through specially crafted Uniform Resource Identifiers that manipulate the application's file handling routines to read arbitrary files from the target system. Attackers can leverage this flaw to access configuration files, user credentials, private keys, and other sensitive data stored on the appliance. The vulnerability is particularly dangerous because it requires no authentication, meaning any remote user can exploit it without prior access credentials. This type of vulnerability maps directly to CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks.
The operational impact of CVE-2019-11510 extends beyond simple information disclosure, as the ability to read arbitrary files can lead to complete system compromise. Attackers can extract sensitive configuration data that may contain database credentials, encryption keys, and system administration details that could facilitate further attacks. The vulnerability creates a persistent threat vector that can be exploited by threat actors to gain unauthorized access to corporate networks and sensitive infrastructure. Organizations using affected Pulse Connect Secure appliances face significant risk of data breaches, compliance violations, and potential lateral movement within their networks.
Mitigation strategies for this vulnerability involve applying the vendor-provided security patches and updates that address the specific path traversal flaw in the affected software versions. Organizations should prioritize immediate patching of all affected appliances and implement network segmentation to limit exposure. Additional protective measures include monitoring network traffic for suspicious URI patterns, implementing web application firewalls, and conducting thorough security assessments of Pulse Connect Secure deployments. This vulnerability aligns with ATT&CK technique T1083 (File and Directory Discovery) and T1566 (Phishing) as attackers may use the information gathered to craft more sophisticated social engineering campaigns. Organizations should also consider implementing the principle of least privilege and regular security audits to reduce the potential impact of similar vulnerabilities in their infrastructure.