CVE-2018-6374

Опубликовано: 31 янв. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 6.4

EPSS Низкий

Описание

The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set.

Ссылки

http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43620
Vendor Advisory
http://www.securityfocus.com/bid/102908
Third Party Advisory
VDB Entry
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43620
Vendor Advisory
http://www.securityfocus.com/bid/102908
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pulsesecure:desktop_linux_client:*:*:*:*:*:*:*:*

Версия до 5.2r9.2 (исключая)

Конфигурация 2

cpe:2.3:a:pulsesecure:desktop_linux_client:*:*:*:*:*:*:*:*

Версия до 5.3r4.2 (исключая)

EPSS

Процентиль: 36%

0.00153

Низкий

6.5 Medium

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-j577-g4xc-mpj3