Vulnerability CVE-2018-6374
Published: 2018-01-31

Description:
The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set.

Type:

CWE-295

 (Certificate Issues)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.4/10
4.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
http://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA43620
http://www.securityfocus.com/bid/102908
Copyright 2024, cxsecurity.com

 

Back to Top