An issue was discovered in Pulse Secure Pulse Connect Secure before 9.1R8. An authenticated attacker can access the admin page console via the end-user web interface because of a rewrite.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15408
Reference (s):
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44516
- https://kb.pulsesecure.net/?atype=sa