« Volver al listado

CVE-2015-5369

Estado: ModificadaMedia (4.3)—

Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Juniper — Pulse Connect Secure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-5369",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-11T14:59:12.710",
  "references": [
    {
      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1033166",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://kb.juniper.net/InfoCenter/index?page=content&id=TSB16756",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1033166",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40004",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://vivaldi.net/en-US/blogs/entry/the-poodle-has-friends",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-17"
        },
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en Pulse Connect Secure (también conocido como PCS y anteriormente Juniper PCS) PSC6000, PCS6500 y MAG PSC360 8.1 en versiones anteriores a 8.1r5, 8.0 en versiones anteriores a 8.0r13, 7.4 en versiones anteriores a 7.4r13.5, 7.1 en versiones anteriores a 7.1r22.2, PPS 5.1 en versiones anteriores a 5.1R5 y 5.0 en versiones anteriores a 5.0R13, cuando está habilitada Hardware Acceleration, no valida correctamente el mensaje del handshake de Finished TLS, lo que hace que sea más fácil para los atacantes remotos realizar ataques man-in-the-middle a través de un mensaje Finished manipulado."
    }
  ],
  "lastModified": "2026-06-17T00:29:01.893",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:juniper:pulse_connect_secure:5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F03BD263-91F8-4AA7-882D-DC86F0896AFB"
            },
            {
              "criteria": "cpe:2.3:a:juniper:pulse_connect_secure:7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58B1967B-76D9-4E46-8E98-594684B53CC7"
            },
            {
              "criteria": "cpe:2.3:a:juniper:pulse_connect_secure:7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C209D3C-C716-4A7F-9665-0C9C1DC2933F"
            },
            {
              "criteria": "cpe:2.3:a:juniper:pulse_connect_secure:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BBDB9656-C040-4434-B484-31C682C55149"
            },
            {
              "criteria": "cpe:2.3:a:juniper:pulse_connect_secure:8.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "274B576D-5D83-4028-9732-0A394CA89FC3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:juniper:mag_pcs360:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D7720B47-1EA4-4AD3-B3C3-CF99BD9A7B18"
            },
            {
              "criteria": "cpe:2.3:h:juniper:pcs6000:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7DD2AAF3-593E-439C-BFD9-E34309D05B4E"
            },
            {
              "criteria": "cpe:2.3:h:juniper:pcs6500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8E50AEE1-08E6-43AE-9F4E-97BA1DECE72A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}