Information disclosure in Juniper Pulse Connect Secure
CVE-2015-7322
The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and 8.1 before 8.1R3 provides different messages for attempts to join a meeting depending on the status of the meeting, which allows remote attackers to enumerate valid meeting ids via a series of requests.
Vulnerability class: Information Disclosure
EPSS: 0.023 (81.7th percentile) — read the EPSS interpretation.
Affected products
- Juniper Pulse_connect_secure — versions 7.1, 7.4, 8.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (Exploit, x_refsource_MISC)