CVE-2017-11455 - CVE House

Status published High CVE-2017-11455

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through...

8.8 CVSS

Vulnerability Description

diag.cgi in Pulse Connect Secure 8.2R1 through 8.2R5, 8.1R1 through 8.1R10 and Pulse Policy Secure 5.3R1 through 5.3R5, 5.2R1 through 5.2R8, and 5.1R1 through 5.1R10 allow remote attackers to hijack the authentication of administrators for requests to start tcpdump, related to the lack of anti-CSRF tokens.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-11455

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from ivanti

View All →

CVE-2022-27088

Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted...

High 7.8

CVE-2021-44720

In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12,...

High 7.2

CVE-2021-38560

Ivanti Service Manager 2021.1 allows reflected XSS via the appName...

Medium 6.1

CVE-2021-36235

An issue was discovered in Ivanti Workspace Control before 10.6.30.0....

High 7.8

CVE-2021-30497

Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read...

High 7.5

Affected Vendor

ivanti

View all reports →

Affected Software

connect secure, pulse connect secure, pulse policy secure

Vulnerable Versions:

8.1, 8.1r1.0, 8.2r1.0, 8.2r1.1, 8.2r2.0, 8.2r3.0, 8.2r3.1, 8.2r4.0, 8.2r4.1, 8.2r5.0, 5.1r1.0, 5.1r1.1, 5.1r2.0, 5.1r2.1, 5.1r3.0, 5.1r3.2, 5.1r4.0, 5.1r5.0, 5.1r6.0, 5.1r7.0, 5.1r7.1, 5.1r8.0, 5.1r9.1, 5.1r10, 5.2r1.0, 5.2r2.0, 5.2r3.0, 5.2r3.2, 5.2r4.0, 5.2r5.0, 5.2r6.0, 5.2r7.0, 5.2r7.1, 5.2r8.0, 5.3r1.0, 5.3r1.1, 5.3r2.0, 5.3r3.0, 5.3r3.1, 5.3r4.0, 5.3r4.1, 5.3r5.0, 5.3r5.1, 5.3r5.2, 5.3r6.0, 5.3r7.0, 5.3r8.0

Timeline

Official Publish: August 29th, 2017

Last Modified: August 5th, 2024

Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.