{"id":"CVE-2020-8256","aliases":["EUVD-2020-29126","GHSA-pcw3-p344-q7jr"],"status":"published","title":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an...","description":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03356,"percentile":0.88796,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611"],"published":"2020-09-29T13:41:32Z","modified":"2026-06-17T03:26:08Z","products":[{"vendor":"ivanti","product":"connect_secure"},{"vendor":"pulsesecure","product":"pulse_connect_secure"}],"references":[{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44588","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8256"},{"url":"https://www.gosecure.net/blog/2020/11/13/forget-your-perimeter-part-2-four-vulnerabilities-in-pulse-connect-secure"},{"url":"https://github.com/advisories/GHSA-pcw3-p344-q7jr"}],"sources":{"cve":[{"id":"CVE-2020-8256","description":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.","status":"published","published":"2020-09-29T13:41:32Z","modified":"2024-11-18T16:03:30.432Z","cwes":["CWE-611"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29126","description":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.","status":"published","published":"2020-09-29T13:41:32Z","modified":"2024-11-18T16:03:30Z","updated_at":"2026-11-03T00:04:57.054288Z"}],"ghsa":[{"id":"GHSA-pcw3-p344-q7jr","title":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an...","description":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.","status":"published","published":"2022-05-24T17:29:53Z","modified":"2024-03-07T05:09:36Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:55:38.886845Z"}],"nvd":[{"id":"CVE-2020-8256","description":"A vulnerability in the Pulse Connect Secure \u003c 9.1R8.2 admin web interface could allow an authenticated attacker to gain arbitrary file reading access through Pulse Collaboration via XML External Entity (XXE) vulnerability.","status":"published","published":"2020-09-30T18:15:29.287Z","modified":"2026-06-17T03:26:08.64Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:17.70091Z"}]}}