Read the docs
TI-2018-14783 Aliases CVE-2018-20812GHSA-64wp-r983-gxp4

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN…

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

An information exposure issue where IPv6 DNS traffic would be sent outside of the VPN tunnel (when Traffic Enforcement was enabled) exists in Pulse Secure Pulse Secure Desktop 9.0R1 and below. This is applicable only to dual-stack (IPv4/IPv6) endpoints.

Why it matters now

EPSS 0.01111 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 53

CPEVersionsRoleVendor
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r1.0:*:*:*:mac_os_x:*:*4.0 r1.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r10.0:*:*:*:mac_os_x:*:*4.0 r10.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r11.0:*:*:*:mac_os_x:*:*4.0 r11.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r11.1:*:*:*:mac_os_x:*:*4.0 r11.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r12.0:*:*:*:mac_os_x:*:*4.0 r12.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r13.0:*:*:*:mac_os_x:*:*4.0 r13.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r2.0:*:*:*:mac_os_x:*:*4.0 r2.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r3.0:*:*:*:mac_os_x:*:*4.0 r3.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r4.0:*:*:*:mac_os_x:*:*4.0 r4.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r5.0:*:*:*:mac_os_x:*:*4.0 r5.0VulnerablePulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r1.0:*:*:*:mac_os_x:*:* Versions 4.0 r1.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r10.0:*:*:*:mac_os_x:*:* Versions 4.0 r10.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r11.0:*:*:*:mac_os_x:*:* Versions 4.0 r11.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r11.1:*:*:*:mac_os_x:*:* Versions 4.0 r11.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r12.0:*:*:*:mac_os_x:*:* Versions 4.0 r12.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r13.0:*:*:*:mac_os_x:*:* Versions 4.0 r13.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r2.0:*:*:*:mac_os_x:*:* Versions 4.0 r2.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r3.0:*:*:*:mac_os_x:*:* Versions 4.0 r3.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r4.0:*:*:*:mac_os_x:*:* Versions 4.0 r4.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r5.0:*:*:*:mac_os_x:*:* Versions 4.0 r5.0 Vulnerable ·Pulse Secure
Show 43 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r6.0:*:*:*:mac_os_x:*:*4.0 r6.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r7.0:*:*:*:mac_os_x:*:*4.0 r7.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r8.0:*:*:*:mac_os_x:*:*4.0 r8.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.0:*:*:*:mac_os_x:*:*4.0 r9.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.1:*:*:*:mac_os_x:*:*4.0 r9.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.2:*:*:*:mac_os_x:*:*4.0 r9.2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r1.0:*:*:*:macos:*:*5.1 r1.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r1.1:*:*:*:macos:*:*5.1 r1.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r10.0:*:*:*:macos:*:*5.1 r10.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r11.0:*:*:*:macos:*:*5.1 r11.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r11.1:*:*:*:macos:*:*5.1 r11.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r12.0:*:*:*:macos:*:*5.1 r12.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r13.0:*:*:*:macos:*:*5.1 r13.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r14.0:*:*:*:macos:*:*5.1 r14.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r2.0:*:*:*:macos:*:*5.1 r2.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r3.0:*:*:*:macos:*:*5.1 r3.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r3.1:*:*:*:macos:*:*5.1 r3.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r4.0:*:*:*:macos:*:*5.1 r4.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r5.1:*:*:*:macos:*:*5.1 r5.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r6.0:*:*:*:macos:*:*5.1 r6.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r7.0:*:*:*:macos:*:*5.1 r7.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r8.0:*:*:*:macos:*:*5.1 r8.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r9.0:*:*:*:macos:*:*5.1 r9.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r9.1:*:*:*:macos:*:*5.1 r9.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1r:3.2:*:*:*:macos:*:*5.1r 3.2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1r:5.0:*:*:*:macos:*:*5.1r 5.0VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1:*:*:*:macos:*:*5.3 r1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.1:*:*:*:macos:*:*5.3 r1.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r2:*:*:*:macos:*:*5.3 r2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r3:*:*:*:macos:*:*5.3 r3VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4:*:*:*:macos:*:*5.3 r4VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.1:*:*:*:macos:*:*5.3 r4.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.2:*:*:*:macos:*:*5.3 r4.2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5:*:*:*:macos:*:*5.3 r5VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.2:*:*:*:macos:*:*5.3 r5.2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r6:*:*:*:macos:*:*5.3 r6VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r7:*:*:*:macos:*:*5.3 r7VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r1:*:*:*:macos:*:*9.0 r1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2:*:*:*:macos:*:*9.0 r2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2.1:*:*:*:macos:*:*9.0 r2.1VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3:*:*:*:macos:*:*9.0 r3VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3.2:*:*:*:macos:*:*9.0 r3.2VulnerablePulse Secure
cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4:*:*:*:macos:*:*9.0 r4VulnerablePulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r6.0:*:*:*:mac_os_x:*:* Versions 4.0 r6.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r7.0:*:*:*:mac_os_x:*:* Versions 4.0 r7.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r8.0:*:*:*:mac_os_x:*:* Versions 4.0 r8.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.0:*:*:*:mac_os_x:*:* Versions 4.0 r9.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.1:*:*:*:mac_os_x:*:* Versions 4.0 r9.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:4.0:r9.2:*:*:*:mac_os_x:*:* Versions 4.0 r9.2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r1.0:*:*:*:macos:*:* Versions 5.1 r1.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r1.1:*:*:*:macos:*:* Versions 5.1 r1.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r10.0:*:*:*:macos:*:* Versions 5.1 r10.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r11.0:*:*:*:macos:*:* Versions 5.1 r11.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r11.1:*:*:*:macos:*:* Versions 5.1 r11.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r12.0:*:*:*:macos:*:* Versions 5.1 r12.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r13.0:*:*:*:macos:*:* Versions 5.1 r13.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r14.0:*:*:*:macos:*:* Versions 5.1 r14.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r2.0:*:*:*:macos:*:* Versions 5.1 r2.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r3.0:*:*:*:macos:*:* Versions 5.1 r3.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r3.1:*:*:*:macos:*:* Versions 5.1 r3.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r4.0:*:*:*:macos:*:* Versions 5.1 r4.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r5.1:*:*:*:macos:*:* Versions 5.1 r5.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r6.0:*:*:*:macos:*:* Versions 5.1 r6.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r7.0:*:*:*:macos:*:* Versions 5.1 r7.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r8.0:*:*:*:macos:*:* Versions 5.1 r8.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r9.0:*:*:*:macos:*:* Versions 5.1 r9.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1:r9.1:*:*:*:macos:*:* Versions 5.1 r9.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1r:3.2:*:*:*:macos:*:* Versions 5.1r 3.2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.1r:5.0:*:*:*:macos:*:* Versions 5.1r 5.0 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1:*:*:*:macos:*:* Versions 5.3 r1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r1.1:*:*:*:macos:*:* Versions 5.3 r1.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r2:*:*:*:macos:*:* Versions 5.3 r2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r3:*:*:*:macos:*:* Versions 5.3 r3 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4:*:*:*:macos:*:* Versions 5.3 r4 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.1:*:*:*:macos:*:* Versions 5.3 r4.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r4.2:*:*:*:macos:*:* Versions 5.3 r4.2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5:*:*:*:macos:*:* Versions 5.3 r5 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r5.2:*:*:*:macos:*:* Versions 5.3 r5.2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r6:*:*:*:macos:*:* Versions 5.3 r6 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:5.3:r7:*:*:*:macos:*:* Versions 5.3 r7 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r1:*:*:*:macos:*:* Versions 9.0 r1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2:*:*:*:macos:*:* Versions 9.0 r2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r2.1:*:*:*:macos:*:* Versions 9.0 r2.1 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3:*:*:*:macos:*:* Versions 9.0 r3 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r3.2:*:*:*:macos:*:* Versions 9.0 r3.2 Vulnerable ·Pulse Secure
  • cpe:2.3:a:pulsesecure:pulse_secure_desktop_client:9.0:r4:*:*:*:macos:*:* Versions 9.0 r4 Vulnerable ·Pulse Secure

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20812
  2. 2026-10-03 Alias added: GHSA-64wp-r983-gxp4

References

Advisory 1

  • TI-2020-10343 A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure… CVSS 3.1HIGH 7.0
  • TI-2020-06657 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 is vulnerable to the client… CVSS 3.1CRITICAL 9.8
  • TI-2020-06672 Path traversal in Pulse Secure Desktop Client CVSS 3.1HIGH 8.8
  • TI-2019-08391 In Pulse Secure Pulse Desktop Client and Network Connect, an attacker could access… CVSS 3.0HIGH 8.1
  • TI-2020-06659 A vulnerability in the Pulse Secure Desktop Client < 9.1R9 could allow the attacker to… CVSS 3.1HIGH 7.5
  • TI-2020-06668 A vulnerability in the Pulse Secure Desktop Client (Linux) < 9.1R9 could allow local attackers to escalate privilege. CVSS 3.1HIGH 7.8
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences