CVE-2020-12880: 
Ivanti Connect Secure vulnerability analysis and mitigation

CVE-2020-12880 is a security vulnerability discovered in Pulse Policy Secure (PPS) and Pulse Connect Secure (PCS) Virtual Appliance versions before 9.1R8. The vulnerability was disclosed in July 2020 (NVD).

The vulnerability allows an attacker to manipulate certain kernel boot parameters, which can trick the system into dropping into a root shell during the pre-install phase. In this state, the entire source code of the appliance becomes accessible and can be retrieved. This is particularly significant because under normal operation, the appliance's hard disks are encrypted and no root shell access is available. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is the potential exposure of the appliance's source code, which is normally inaccessible due to disk encryption and operational security measures. This could provide attackers with valuable insights into the system's internal workings and potentially lead to the discovery of additional vulnerabilities (NVD).

The vulnerability requires local access and low privileges to exploit. The attack complexity is considered low, but user interaction is not required for exploitation (NVD).

The vulnerability was addressed in Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) version 9.1R8. Organizations using affected versions should upgrade to this version or later to mitigate the vulnerability (Vendor Advisory).