Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-11455 |
CWE-ID | CWE-352 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Pulse Policy Secure Server applications / Remote access servers, VPN Pulse Connect Secure Server applications / Remote access servers, VPN |
Vendor | Pulse Secure |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU8032
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2017-11455
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote authenticated attacker to perform CSRF attack.
The weakness exists due to improper input validation. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system, trigger a flaw in 'diag.cgi and perform arbitrary actions.
MitigationThe vulnerability is addressed in the following versions: 8.3R1, 8.2R6, 8.1R12, 8.0R17 and 5.4R1, 5.3R6, 5.2R9, 5.1R12.
Vulnerable software versionsPulse Policy Secure: All versions
Pulse Connect Secure: All versions
Fixed software versionsCPE2.3 External links
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40793
Q & A
Can this vulnerability be exploited remotely?
How the attacker can exploit this vulnerability?
Is there known malware, which exploits this vulnerability?