CVE-2020-8243: 
Ivanti Connect Secure vulnerability analysis and mitigation

A vulnerability identified as CVE-2020-8243 was discovered in Pulse Connect Secure versions prior to 9.1R8.2. The vulnerability affects the admin web interface of the system and was disclosed on September 30, 2020. This security flaw specifically impacts Pulse Connect Secure's administrative interface functionality (NVD, CVE Mitre).

The vulnerability has been assigned a CVSS score of 7.0, indicating a moderate to high severity level. The attack requires network access and single authentication for exploitation. The CVSS vector string is (AV:N/AC:L/Au:S/C:P/I:P/A:P), suggesting that the vulnerability can be exploited over the network with low attack complexity, requires single authentication, and can impact partial confidentiality, integrity, and availability (Rapid7).

If successfully exploited, this vulnerability allows an authenticated attacker to upload custom templates to the admin web interface, potentially leading to arbitrary code execution on the affected system (NVD).

The vulnerability has been actively exploited in the wild. According to CISA, threat actors have leveraged this vulnerability along with others (CVE-2019-11510, CVE-2020-8260, and CVE-2021-22893) to gain initial access to systems and deploy webshells for further access and persistence (Decipher).

The vulnerability has been patched in Pulse Connect Secure version 9.1R8.2. Organizations are strongly advised to upgrade to this version or later to mitigate the risk. Ivanti has also released a tool that can check the integrity of the PCS software (Decipher).