PT-2015-7524 · Pulse · Pulse Connect Secure

Philipp Rocholl · Publicado 2015-10-05 · Atualizado 2016-12-08 · CVE-2015-7323

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulse Connect Secure versions prior to 7.1R22.1 Pulse Connect Secure versions prior to 7.4 Pulse Connect Secure versions 8.0 through 8.0R10 Pulse Connect Secure versions 8.1 through 8.1R2

Description The issue allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar.

Recommendations For versions prior to 7.1R22.1, update to version 7.1R22.1 or later. For versions prior to 7.4, update to version 7.4 or later. For versions 8.0 through 8.0R10, update to version 8.0R11 or later. For versions 8.1 through 8.1R2, update to version 8.1R3 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-7323

Produtos afetados

Pulse Connect Secure

Referências · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Sep/98 · Exploit
• 🔥 https://packetstormsecurity.com/files/133711/Junos-Pulse-Secure-Meeting-8.0.5-Access-Bypass.html · Exploit
• 🔥 https://profundis-labs.com/advisories/CVE-2015-7323.txt · Exploit
• http://securitytracker.com/id/1033684 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7323 · Nota de Segurança
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40054 · Aviso do Fabricante