How severe is CVE-2018-9849?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Pulsesecure Pulse Connect Secure

CVE-2018-9849

Pulse Secure Pulse Connect Secure 8.1.x before 8.1R14, 8.2.x before 8.2R11, and 8.3.x before 8.3R5 do not properly process nested XML entities, which allows remote attackers to cause a denial of service (memory consumption and memory errors) via a crafted XML document.

EPSS: 0.010 (58.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.

Affected products

Pulsesecure Pulse_connect_secure
N/a — versions n/a

References

cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-9849?: CVE-2018-9849 is a medium-severity vulnerability in Pulsesecure Pulse Connect Secure. CVSS score: 5.5/10. Published 2018-05-10.
How severe is CVE-2018-9849?: Medium severity. CVSS v3 base score is 5.5 out of 10.