CVE:CVE-2017-11455
CNNVD:CNNVD-201707-873
Pulse Connect Secure和Pulse Policy Secure都是美国Pulse Secure公司的产品。Pulse Connect Secure是一套SSL VPN解决方案。Pulse Policy Secure是一套NAC和BYOD解决方案。
Pulse Connect Secure和Pulse Policy Secure中的diag.cgi文件存在跨站请求伪造漏洞，该漏洞源于程序没有正确的验证HTTP请求。远程攻击者可利用该漏洞执行未授权的操作，获取受影响应用程序的访问权限。以下产品和版本受到影响：Pulse Connect Secure 8.2R1版本至8.2R5版本，8.1R1版本至8.1R10版本；Pulse Policy Secure 5.3R1版本至5.3R5版本，5.2R1版本至5.2R8版本，5.1R1版本至5.1R10版本。
solution:Upgrade pulsesecure pulse_connect_secure to a higher version than 8.1,8.1r1.0,8.2r1.0,8.2r1.1,8.2r2.0,8.2r3.0,8.2r3.1,8.2r4.0,8.2r4.1,8.2r5.0,and avoid the version 8.1,8.1r1.0,8.2r1.0,8.2r1.1,8.2r2.0,8.2r3.0,8.2r3.1,8.2r4.0,8.2r4.1,8.2r5.0; Upgrade pulsesecure pulse_policy_secure to a higher version than 5.1r1.0,5.1r1.1,5.1r2.0,5.1r2.1,5.1r3.0,5.1r3.2,5.1r4.0,5.1r5.0,5.1r6.0,5.1r7.0,5.1r7.1,5.1r8.0,5.1r9.1,5.1r10,5.2r1.0,5.2r2.0,5.2r3.0,5.2r3.2,5.2r4.0,5.2r5.0,5.2r6.0,5.2r7.0,5.2r7.1,5.2r8.0,5.3r1.0,5.3r1.1,5.3r2.0,5.3r3.0,5.3r3.1,5.3r4.0,5.3r4.1,5.3r5.0,5.3r5.1,5.3r5.2,5.3r6.0,5.3r7.0,5.3r8.0,and avoid the version 5.1r1.0,5.1r1.1,5.1r2.0,5.1r2.1,5.1r3.0,5.1r3.2,5.1r4.0,5.1r5.0,5.1r6.0,5.1r7.0,5.1r7.1,5.1r8.0,5.1r9.1,5.1r10,5.2r1.0,5.2r2.0,5.2r3.0,5.2r3.2,5.2r4.0,5.2r5.0,5.2r6.0,5.2r7.0,5.2r7.1,5.2r8.0,5.3r1.0,5.3r1.1,5.3r2.0,5.3r3.0,5.3r3.1,5.3r4.0,5.3r4.1,5.3r5.0,5.3r5.1,5.3r5.2,5.3r6.0,5.3r7.0,5.3r8.0