{"id":"CVE-2021-44720","aliases":["EUVD-2021-31535","GHSA-wvx3-vg8q-qgjv"],"status":"published","title":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is...","description":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the \"Maintenance \u003e Push Configuration \u003e Targets \u003e Target Name\" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02276,"percentile":0.83229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2022-08-11T15:49:27Z","modified":"2026-06-17T04:12:45Z","products":[{"vendor":"ivanti","product":"connect_secure"},{"vendor":"pulsesecure","product":"pulse_connect_secure"}],"references":[{"url":"https://kb.pulsesecure.net/?atype=sa","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://gist.github.com/JGarciaSec/2060ec1c8efc1d573a1ddb754c6b4f84","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44720"},{"url":"https://github.com/advisories/GHSA-wvx3-vg8q-qgjv"}],"sources":{"cve":[{"id":"CVE-2021-44720","description":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the \"Maintenance \u003e Push Configuration \u003e Targets \u003e Target Name\" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.","status":"published","published":"2022-08-11T15:49:27Z","modified":"2024-08-04T04:32:12.296Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31535","description":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the \"Maintenance \u003e Push Configuration \u003e Targets \u003e Target Name\" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.","status":"published","published":"2022-08-11T15:49:27Z","modified":"2024-08-04T04:32:12Z","updated_at":"2026-11-03T03:08:28.560815Z"}],"ghsa":[{"id":"GHSA-wvx3-vg8q-qgjv","title":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is...","description":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the \"Maintenance \u003e Push Configuration \u003e Targets \u003e Target Name\" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.","status":"published","published":"2022-08-13T00:00:42Z","modified":"2023-01-28T05:06:14Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:44:24.844334Z"}],"nvd":[{"id":"CVE-2021-44720","description":"In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the \"Maintenance \u003e Push Configuration \u003e Targets \u003e Target Name\" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.","status":"published","published":"2022-08-12T15:15:09.17Z","modified":"2026-06-17T04:12:45.96Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:07:06.906968Z"}]}}