CVE-2020-15408: 
Ivanti Connect Secure vulnerability analysis and mitigation

An authentication bypass vulnerability was discovered in Pulse Connect Secure before version 9.1R8 that allows an authenticated attacker to access the admin page console via the end-user web interface due to a rewrite issue (CVE Details).

The vulnerability exists due to a rewrite issue that allows authenticated users to access administrative console pages through the end-user web interface. The vulnerability has a CVSS v3 Base Score of 7.2 (High) with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: High, User Interaction: None, Scope: Unchanged, and Impact scores of High for Confidentiality, Integrity and Availability (AttackerKB).

If successfully exploited, this vulnerability allows authenticated users to gain unauthorized access to administrative console pages, potentially leading to complete system compromise through administrative access. The high CVSS impact scores across confidentiality, integrity and availability indicate severe potential consequences if exploited (AttackerKB).

The primary mitigation is to upgrade Pulse Connect Secure to version 9.1R8 or later which contains fixes for this vulnerability (CVE Details).