{"vulnerability": "CVE-2020-8956", "sightings": [{"uuid": "a7acda59-99da-4041-b70e-5d5187b35605", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "2a680e53-38d5-4816-bf60-f2ab9376601e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:32.000000Z"}, {"uuid": "f384016b-01b9-49a0-a4ab-8a152d3524b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/pulse_secure.rb", "content": "", "creation_timestamp": "2020-12-04T16:11:49.000000Z"}, {"uuid": "56f3322f-5ef4-42c0-9285-bfcafeee3fb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "https://t.me/cibsecurity/15602", "content": "\u203c CVE-2020-8956 \u203c\n\nPulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-10-27T11:29:54.000000Z"}, {"uuid": "2482b7cb-47e4-4a1e-a967-9ea13fec63b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-8956", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/windows/gather/credentials/pulse_secure.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Quentin Kaiser \"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": true, \"default_credential\": false, \"description\": \"This module extracts and decrypts saved Pulse Secure Connect Client passwords from the\\n          Windows Registry. This module can only access credentials created by the user that the\\n          Meterpreter session is running as.\\n          Note that this module cannot link the password to a username unless the\\n          Meterpreter sessions is running as SYSTEM. This is because the username associated\\n          with a password is saved in 'C:\\\\ProgramData\\\\Pulse Secure\\\\ConnectionStore\\\\[SID].dat',\\n          which is only readable by SYSTEM.\\n          Note that for enterprise deployment, this username is almost always the domain\\n          username.\", \"disclosure_date\": null, \"fullname\": \"post/windows/gather/credentials/pulse_secure\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:52:36 +0000\", \"name\": \"Windows Pulse Secure Connect Client Saved Password Extractor\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/windows/gather/credentials/pulse_secure.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/gather/credentials/pulse_secure\", \"references\": [\"CVE-2020-8956\", \"URL-https://qkaiser.github.io/reversing/2020/10/27/pule-secure-credentials\", \"URL-https://www.gremwell.com/blog/reversing_pulse_secure_client_credentials_store\", \"URL-https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601\"], \"rport\": null, \"session_types\": [\"meterpreter\"], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.953957Z"}]}