CVE-2020-13162
HIGH 7.0EPSS 0.8%
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down to 5.3 R70 for Windows (which runs as NT AUTHORITY/SYSTEM) allows unprivileged users to run a Microsoft Installer executable with elevated privileges.
- CVSS v3.1
- 7.0 HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 7.0 HIGH
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C - EPSS
- 0.79% chance of exploitation in the next 30 days, 54th percentile
- Published
- 2020-06-16
- Updated
- 2025-05-05
Proof-of-concept exploits (2)
- http://seclists.org/fulldisclosure/2020/Sep/15
- redtimmy/tu-TOCTOU-kaiu-TOCMEU-CVE-2020-13162-10★ · 2020-09-02