CVE-2020-8255: 
Pulse Secure Desktop Client vulnerability analysis and mitigation

A vulnerability was identified in the Pulse Connect Secure admin web interface affecting versions prior to 9.1R9. This security flaw, tracked as CVE-2020-8255, was disclosed on October 28, 2020, and allows authenticated attackers to perform arbitrary file reading operations (NVD, CVE Mitre).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.9 (Medium severity). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires high privileges (PR:H), and no user interaction (UI:N). The scope is unchanged (S:U), with potential high impact on confidentiality (C:H) but no impact on integrity (I:N) or availability (A:N) (AttackerKB).

The successful exploitation of this vulnerability could lead to unauthorized file reading capabilities, potentially exposing sensitive information to authenticated attackers with high privileges. The impact is primarily focused on confidentiality, with no direct effect on system integrity or availability (NVD).

The vulnerability requires an authenticated user with high privileges to exploit, which somewhat limits its potential for widespread abuse. The attack complexity is considered low, indicating that once the prerequisite access is obtained, the vulnerability is relatively straightforward to exploit (AttackerKB).

The vulnerability has been fixed in Pulse Connect Secure version 9.1R9 and later releases. The fix implements encrypted URL blacklisting to prevent unauthorized file reading operations (CVE Mitre).