Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
BID:100530
CVE-2017-11455 |Info
Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
| Bugtraq ID: | 100530 |
| Class: | Input Validation Error |
| CVE: |
CVE-2017-11455 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 29 2017 12:00AM |
| Updated: | Aug 29 2017 12:00AM |
| Credit: | David Dworken |
| Vulnerable: |
Pulse Secure Pulse Policy Secure 5.3R5 Pulse Secure Pulse Policy Secure 5.3R2 Pulse Secure Pulse Policy Secure 5.3R1 Pulse Secure Pulse Policy Secure 5.2R8 Pulse Secure Pulse Policy Secure 5.2R6 Pulse Secure Pulse Policy Secure 5.2R5 Pulse Secure Pulse Policy Secure 5.2R1 Pulse Secure Pulse Policy Secure 5.1R8 Pulse Secure Pulse Policy Secure 5.1R7 Pulse Secure Pulse Policy Secure 5.1R10 Pulse Secure Pulse Policy Secure 5.1R1 Pulse Secure Pulse Connect Secure 8.2R5 Pulse Secure Pulse Connect Secure 8.2R1.1 Pulse Secure Pulse Connect Secure 8.2R1 Pulse Secure Pulse Connect Secure 8.1R7 Pulse Secure Pulse Connect Secure 8.1R6 Pulse Secure Pulse Connect Secure 8.1R5 Pulse Secure Pulse Connect Secure 8.1R4 Pulse Secure Pulse Connect Secure 8.1R3 Pulse Secure Pulse Connect Secure 8.1R2 Pulse Secure Pulse Connect Secure 8.1R10 Pulse Secure Pulse Connect Secure 8.1R1 |
| Not Vulnerable: |
Pulse Secure Pulse Policy Secure 5.4R1 Pulse Secure Pulse Policy Secure 5.3R6 Pulse Secure Pulse Policy Secure 5.2R9 Pulse Secure Pulse Policy Secure 5.1R12 Pulse Secure Pulse Connect Secure 8.3R1 Pulse Secure Pulse Connect Secure 8.2R6 Pulse Secure Pulse Connect Secure 8.1R12 Pulse Secure Pulse Connect Secure 8.0R17 |
Discussion
Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
Multiple Pulse Secure Products are prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
The following products are vulnerable:
Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10
Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10
Multiple Pulse Secure Products are prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.
Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.
The following products are vulnerable:
Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10
Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10
Exploit / POC
Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Pulse Secure Products CVE-2017-11455 Cross-Site Request Forgery Vulnerability
References:
References:
- Pulse Secure Homepage (Pulse Secure)
- SA40793 - CSRF vulnerability in Pulse Connect Secure / Pulse Policy Secure (CVE- (Pulse Secure)