Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-11455 |
CWE-ID | CWE-352 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Ivanti Policy Secure (formerly Pulse Policy Secure) Server applications / Remote access servers, VPN Ivanti Connect Secure (formerly Pulse Connect Secure) Server applications / Remote access servers, VPN |
Vendor | Ivanti |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU8032
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-11455
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to perform CSRF attack.
The weakness exists due to improper input validation. A remote attacker can create a specially crafted HTML page or URL, trick the victim into visiting it, gain access to the system, trigger a flaw in 'diag.cgi and perform arbitrary actions.
MitigationThe vulnerability is addressed in the following versions: 8.3R1, 8.2R6, 8.1R12, 8.0R17 and 5.4R1, 5.3R6, 5.2R9, 5.1R12.
Vulnerable software versionsIvanti Policy Secure (formerly Pulse Policy Secure): All versions
Ivanti Connect Secure (formerly Pulse Connect Secure): All versions
External linkshttp://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40793
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.