How severe is CVE-2015-5369?

CVE-2015-5369 has a CVSS 2.0 base score of 4.3, rated medium severity.

Is CVE-2015-5369 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-5369?

CVE-2015-5369 primarily affects Juniper Pulse Connect Secure. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-5369?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-5369 published?

CVE-2015-5369 was published on 2015-08-11 and last updated on 2026-06-17.

CVE-2015-5369

CVE-2015-5369 is a medium-severity vulnerability in Juniper Pulse Connect Secure with a CVSS 2.0 base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-17.

Key facts

Severity: Medium (CVSS 2.0 base score 4.3)
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-17
Affected product: Juniper Pulse Connect Secure
Published: 2015-08-11
Last modified: 2026-06-17

Description

Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.

Frequently asked questions

What is CVE-2015-5369?: Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
How severe is CVE-2015-5369?: CVE-2015-5369 has a CVSS 2.0 base score of 4.3, rated medium severity.
Is CVE-2015-5369 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-5369?: CVE-2015-5369 primarily affects Juniper Pulse Connect Secure. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-5369?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-5369 published?: CVE-2015-5369 was published on 2015-08-11 and last updated on 2026-06-17.

References

Affected products (5)

cpe:2.3:a:juniper:pulse_connect_secure:5.1:*:*:*:*:*:*:*
cpe:2.3:a:juniper:pulse_connect_secure:7.1:*:*:*:*:*:*:*
cpe:2.3:a:juniper:pulse_connect_secure:7.4:*:*:*:*:*:*:*
cpe:2.3:a:juniper:pulse_connect_secure:8.0:*:*:*:*:*:*:*
cpe:2.3:a:juniper:pulse_connect_secure:8.1:*:*:*:*:*:*:*

More vulnerabilities in Juniper Pulse Connect Secure

CVE-2015-7322 — Medium (CVSS 5.0): The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4,…
CVE-2015-7323 — Low (CVSS 3.5): The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4,…

All CVEs affecting Juniper Pulse Connect Secure →

Other CWE-17 vulnerabilities

CVE-2015-5887 — Critical (CVSS 10.0): The TLS Handshake Protocol implementation in Secure Transport in Apple OS X before 10.11 accepts a Certificate Request…
CVE-2015-2738 — Critical (CVSS 10.0): The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before…
CVE-2015-2737 — Critical (CVSS 10.0): The rx::d3d11::SetBufferData function in the Direct3D 11 implementation in Mozilla Firefox before 39.0, Firefox ESR…
CVE-2015-2734 — Critical (CVSS 10.0): The CairoTextureClientD3D9::BorrowDrawTarget function in the Direct3D 9 implementation in Mozilla Firefox before 39.0,…
CVE-2015-4335 — Critical (CVSS 10.0): Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
CVE-2015-3292 — Critical (CVSS 10.0): The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging…

Browse all CWE-17 vulnerabilities →