CVE-2019-11213

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-12 · updated 2026-06-17
Weakness: CWE-384

Description

In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access session tokens to replay and spoof sessions, and as a result, gain unauthorized access as an end user, a related issue to CVE-2019-1573. (The endpoint would need to be already compromised for exploitation to succeed.) This affects Pulse Desktop Client 5.x before Secure Desktop 5.3R7 and Pulse Desktop Client 9.x before Secure Desktop 9.0R3. It also affects (for Network Connect customers) Pulse Connect Secure 8.1 before 8.1R14, 8.3 before 8.3R7, and 9.0 before 9.0R3.

Affected products

Ivanti Connect Secure (Pulse Secure): from 9.0r1 before 9.0r3 — fixed in 9.0r3
Ivanti Connect Secure (Pulse Secure): from 8.1r1.0 through 8.1r14.0; from 8.3r1 before 8.3r7 — fixed in 8.3r7
Pulse Secure Desktop Client: from 5.0r1.0 before 5.3r7; from 9.0r1 before 9.0r3 — fixed in 5.3r7, 9.0r3

How to fix

Upgrade to a fixed version: Ivanti Connect Secure (Pulse Secure) 9.0r3; Ivanti Connect Secure (Pulse Secure) 8.3r7; Pulse Secure Desktop Client 5.3r7, 9.0r3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-11213 or the next vulnerability affects your stack