CVEvulnerability

CVE-2015-5369

4.3 MEDIUM Published 2015-08-11 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-08-11
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-17, CWE-20

Description

Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.

Affected configurations

• juniper pulse connect secure 5.1 • juniper pulse connect secure 7.1 • juniper pulse connect secure 7.4 • juniper pulse connect secure 8.0 • juniper pulse connect secure 8.1

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References