{"api_version":"1","generated_at":"2026-07-23T15:09:19+00:00","cve":"CVE-2015-5369","urls":{"html":"https://cve.report/CVE-2015-5369","api":"https://cve.report/api/cve/CVE-2015-5369.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-5369","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-5369"},"summary":{"title":"CVE-2015-5369","description":"Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-08-11 14:59:12","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-17","CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1033166","name":"http://www.securitytracker.com/id/1033166","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Juniper Pulse Secure TCP Hardware Acceleration Flaw Lets Remote Users Access Data on the Target System - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756","name":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Juniper Networks - [Pulse Secure] TLS connection verification issue (CVE-2015-5369)   - Knowledge Base","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends","name":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Vivaldi Web Browser Community - 404 - Not Found","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004","name":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Public KB - SA40004 - [Pulse Secure] TLS connection verification issue (CVE-2015-5369)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5369","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5369","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"5369","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"juniper","cpe5":"mag_pcs360","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"juniper","cpe5":"pcs6000","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"juniper","cpe5":"pcs6500","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"juniper","cpe5":"pulse_connect_secure","cpe6":"5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"juniper","cpe5":"pulse_connect_secure","cpe6":"7.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"juniper","cpe5":"pulse_connect_secure","cpe6":"7.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"juniper","cpe5":"pulse_connect_secure","cpe6":"8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"5369","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"juniper","cpe5":"pulse_connect_secure","cpe6":"8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T06:41:09.315Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756"},{"name":"1033166","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1033166"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-07-14T00:00:00.000Z","descriptions":[{"lang":"en","value":"Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-08-11T13:57:04.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends"},{"tags":["x_refsource_CONFIRM"],"url":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756"},{"name":"1033166","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1033166"},{"tags":["x_refsource_CONFIRM"],"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-5369","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends","refsource":"MISC","url":"https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends"},{"name":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756","refsource":"CONFIRM","url":"http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756"},{"name":"1033166","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1033166"},{"name":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004","refsource":"CONFIRM","url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-5369","datePublished":"2015-08-11T14:00:00.000Z","dateReserved":"2015-07-06T00:00:00.000Z","dateUpdated":"2024-08-06T06:41:09.315Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-08-11 14:59:12","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-17","CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:juniper:pulse_connect_secure:5.1:*:*:*:*:*:*:*","matchCriteriaId":"F03BD263-91F8-4AA7-882D-DC86F0896AFB"},{"vulnerable":true,"criteria":"cpe:2.3:a:juniper:pulse_connect_secure:7.1:*:*:*:*:*:*:*","matchCriteriaId":"58B1967B-76D9-4E46-8E98-594684B53CC7"},{"vulnerable":true,"criteria":"cpe:2.3:a:juniper:pulse_connect_secure:7.4:*:*:*:*:*:*:*","matchCriteriaId":"0C209D3C-C716-4A7F-9665-0C9C1DC2933F"},{"vulnerable":true,"criteria":"cpe:2.3:a:juniper:pulse_connect_secure:8.0:*:*:*:*:*:*:*","matchCriteriaId":"BBDB9656-C040-4434-B484-31C682C55149"},{"vulnerable":true,"criteria":"cpe:2.3:a:juniper:pulse_connect_secure:8.1:*:*:*:*:*:*:*","matchCriteriaId":"274B576D-5D83-4028-9732-0A394CA89FC3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:juniper:mag_pcs360:-:*:*:*:*:*:*:*","matchCriteriaId":"D7720B47-1EA4-4AD3-B3C3-CF99BD9A7B18"},{"vulnerable":false,"criteria":"cpe:2.3:h:juniper:pcs6000:-:*:*:*:*:*:*:*","matchCriteriaId":"7DD2AAF3-593E-439C-BFD9-E34309D05B4E"},{"vulnerable":false,"criteria":"cpe:2.3:h:juniper:pcs6500:-:*:*:*:*:*:*:*","matchCriteriaId":"8E50AEE1-08E6-43AE-9F4E-97BA1DECE72A"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"5369","Ordinal":"1","Title":"CVE-2015-5369","CVE":"CVE-2015-5369","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"5369","Ordinal":"1","NoteData":"Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.","Type":"Description","Title":"CVE-2015-5369"},{"CveYear":"2015","CveId":"5369","Ordinal":"2","NoteData":"2015-08-11","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"5369","Ordinal":"3","NoteData":"2015-08-11","Type":"Other","Title":"Modified"}]}}}