Critical Arbitrary File Read in Ivanti Pulse Connect Secure (CVE‑2019‑11510) Threatens Remote Access
What It Is – Ivanti Pulse Connect Secure (PCS) suffers an unauthenticated arbitrary file‑read flaw. An attacker who can reach the appliance over HTTPS can craft a URI that forces the server to disclose any file it can read from the underlying filesystem.
Exploitability – The vulnerability is remotely exploitable without credentials. Public PoCs exist and the CVSS v3.1 base score is 9.8 (Critical).
Affected Products – Ivanti Pulse Connect Secure (all versions prior to the vendor‑released patch in 2020).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that remote‑access gateways are patched and that file‑system exposure is tightly controlled.
- Highlights gaps in evidence collection: without proper logging, an attacker’s activity may go unnoticed, weakening audit trails.
- Directly tests the control objective of “Secure Configuration Management” that underpins many frameworks (e.g., NIST CSF Identify & Protect).
Recommended Actions
- Apply Ivanti’s security patch immediately and verify the running version.
- Conduct a configuration review to ensure least‑privilege file system permissions on the appliance.
- Enable and centralize detailed HTTPS request logging; forward logs to a SIEM for continuous monitoring.
- Run a vulnerability scan focused on remote‑access appliances to confirm remediation.
- Document the remediation steps as evidence for audit readiness.
Source: CISA KEV – CVE‑2019‑11510