---
title: "Pulse Secure File Read (CVE-2019-11510)"
canonical: https://trickest.com/library/cve-2019-11510-pulse-connect-secure-file-read
description: "Flag Pulse Connect Secure hosts for CVE-2019-11510 by reading version from GET /dana-na/nc/nc_gina_ver.txt. Floors 8.2R12.1 / 8.3R7.1 / 9.0R3.4."
---

# Pulse Secure File Read (CVE-2019-11510)

## Overview

This workflow finds Ivanti Pulse Connect Secure and sorts each host by whether its version falls below the CVE-2019-11510 fixed floors. CVE-2019-11510 is unauthenticated arbitrary file read through a path traversal on the VPN appliance. This check never walks a path traversal and never asks for a sensitive file. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/dana-na/nc/nc_gina_ver.txt` only, fingerprints Pulse Connect Secure from that version text, reads the release string, and compares it to the 8.2R12.1, 8.3R7.1, and 9.0R3.4 floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when edge VPN appliances lag on maintenance releases. A gateway frozen on 9.0R3.3 is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/dana-na/nc/nc_gina_ver.txt` on each host and fingerprint Pulse Connect Secure from the version text in that response.
3. Parse the release string and compare it to the CVE-2019-11510 floors in the graph (8.2R12.1, 8.3R7.1, 9.0R3.4).
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Pulse Connect Secure was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/dana-na/nc/nc_gina_ver.txt` only. No path traversal and no sensitive file read.

## Sample output

The records below are illustrative and do not come from a real run. They show one Pulse Connect Secure host below a CVE-2019-11510 floor, one at or above its floor, and one host that is not the product.

```jsonl
{"url": "https://vpn.example.com", "is_product": true, "product_version": "9.0R3.3", "vulnerable": true, "detail": "below floor 9.0R3.4"}
{"url": "https://vpn.example.org", "is_product": true, "product_version": "9.0R3.4", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Pulse Connect Secure"}
```

```json
{"cve": "CVE-2019-11510", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Pulse Connect Secure versions does this flag?

Builds below the floors in the graph: 8.2R12.1, 8.3R7.1, and 9.0R3.4. The compare uses the version text `/dana-na/nc/nc_gina_ver.txt` itself served.

### Does an affected row mean a sensitive file was read?

No. The check only GETs `/dana-na/nc/nc_gina_ver.txt` and reads the version string. It does not walk a path traversal and it does not confirm arbitrary file read.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public version endpoint. It does not authenticate or pull session data.

### Does the check need credentials?

No. It fingerprints the public version text the way an external scanner would.

### What is CVE-2019-11510?

Unauthenticated arbitrary file read in Ivanti Pulse Connect Secure through a path traversal. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Pulse Secure Cmd Inject (CVE-2019-11539)](/library/cve-2019-11539-pulse-connect-secure-cmd-injection). Reach for it when you need the admin command injection check on the same VPN fleet.
- [Ivanti Auth Bypass (CVE-2023-46805)](/library/ivanti-auth-bypass-check-cve-2023-46805). Reach for it when you need a newer Ivanti auth bypass check.
- [NetScaler SD-WAN RCE (CVE-2017-6316)](/library/cve-2017-6316-citrix-netscaler-sdwan-rce). Reach for it when the next edge appliance is Citrix SD-WAN / CloudBridge.

---
_Markdown source of https://trickest.com/library/cve-2019-11510-pulse-connect-secure-file-read._