CVE-2017-11455
Summary
| CVE | CVE-2017-11455 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-08-29 15:29:00 UTC |
| Updated | 2020-04-29 17:32:00 UTC |
| Description | diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens. |
Risk And Classification
Problem Types: CWE-352
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Pulsesecure | Pulse Connect Secure | 8.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.1r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r3.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r4.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.1r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r3.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r4.1 | All | All | All |
| Application | Pulsesecure | Pulse Connect Secure | 8.2r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r10 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r2.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r3.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r7.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r8.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r9.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r3.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r7.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r8.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r3.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r4.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r8.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r10 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r2.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r3.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r7.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r8.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.1r9.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r3.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r7.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.2r8.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r1.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r1.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r2.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r3.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r3.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r4.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r4.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.1 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r5.2 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r6.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r7.0 | All | All | All |
| Application | Pulsesecure | Pulse Policy Secure | 5.3r8.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pulse Connect Secure Access Control Flaw in 'diag.cgi' Lets Remote Users Conduct Cross-Site Request Forgery Attacks - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Public KB - SA40793 - CSRF vulnerability in Pulse Connect Secure / Pulse Policy Secure (CVE-2017-11455) | CONFIRM | kb.pulsesecure.net | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.