Summary
Ivanti heeft kwetsbaarheden verholpen in Connect Secure en Policy Secure.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
* Denial-of-Service (DoS)
* Cross-Site Scripting (XSS)
* Verhoogde gebruikersrechten
* (Remote) code execution (Gebruikersrechten)
Om code executie te verkrijgen is voorafgaande authenticatie met admin rechten vereist. Kwetsbaarheid met kenmerk CVE-2024-11004 kan echter misbruikt worden om op afstand zonder authenticatie admin rechten te verkrijgen. Hiervoor moet een gebruiker wel met admin rechten verleid worden om een malafide webpagina te openen.
Oplossingen
Ivanti heeft fixes uitgebracht om de kwetsbaarheid te verhelpen voor versies Connect Secure versie 22.7R2.3 en Policy Secure 22.7R1.2. Zie de referentie voor meer informatie.
Vulnerabilities 18
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure b…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
Critical 9.1
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before versio…
-
High 8.8
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version …
-
High 7.8
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy S…
-
High 7.8
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Polic…
-
High 7.5
An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trig…
-
High 7.5
An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remo…
-
High 7.5
A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated…
-
High 7.5
A null pointer dereference in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
-
Medium 4.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version …
Revision history
-
#0
Initiele versie
References
-
Reference - cveprojectv5
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs