CVE-2020-8956 Information disclosure in n/a
Attackers can reveal user passwords if the Save Settings feature is enabled in the Pulse Secure Desktop Client.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8956?
CVE-2020-8956 is a low-severity vulnerability in n/a, published on 27 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
Weakness: CWE-521
Which versions are affected by CVE-2020-8956?
It affects 1 product.
Products include Pulsesecure Pulse Secure Desktop.
How do I fix CVE-2020-8956?
No fix has been published for CVE-2020-8956 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8956 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8956 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rw4x-mrcc-6rwp.