Overview
- Description
- The GUI component (aka PulseUI) in Pulse Secure Desktop Linux clients before PULSE5.2R9.2 and 5.3.x before PULSE5.3R4.2 does not perform strict SSL Certificate Validation. This can lead to the manipulation of the Pulse Connection set.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 2.5
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 6.4
- Impact score
- 4.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-295
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pulsesecure:desktop_linux_client:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3F511253-7B9A-47CB-937D-C697138473D6",
"versionEndExcluding": "5.2r9.2"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:pulsesecure:desktop_linux_client:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78EEFD1A-1D7B-40FA-8885-923B76027ED0",
"versionEndExcluding": "5.3r4.2"
}
],
"operator": "OR"
}
]
}
]