Design/Logic Flaw

2015-10-0515:59:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.3%

JSON

The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 allows remote authenticated users to bypass intended access restrictions and log into arbitrary meetings by leveraging a meeting id and meetingAppSun.jar.

CPENameOperatorVersion
pulse_connect_secureeq8.0
pulse_connect_secureeq7.4
pulse_connect_secureeq8.1
pulse_connect_secureeq7.1

Name	Operator	Version
pulse_connect_secure	eq	8.0
pulse_connect_secure	eq	7.4
pulse_connect_secure	eq	8.1
pulse_connect_secure	eq	7.1

References

seclists.org/fulldisclosure/2015/Sep/98

www.securitytracker.com/id/1033684

kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40054

packetstormsecurity.com/files/133711/Junos-Pulse-Secure-Meeting-8.0.5-Access-Bypass.html

profundis-labs.com/advisories/CVE-2015-7323.txt