Summary
Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Rechte zu erweitern, beliebigen Code auszuführen, Daten zu manipulieren und vertrauliche Informationen preiszugeben.
Product
Connect Secure bietet TLS- und mobile VPN-Lösungen.
Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung.
Der Ivanti Secure Access Client ist ein VPN Client für Ivanti Connect Secure.
Vulnerabilities 8
-
Critical 9.9
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker t…
-
Critical 9.1
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows…
-
Critical 9.1
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before versio…
-
High 7.1
Insufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to …
-
Medium 6.8
External control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versio…
-
Medium 6.1
Reflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows …
-
Medium 6.0
A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allow…
-
Medium 6.0
Cleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before versi…
Revision history
-
#1
Initiale Fassung
References
-
Ivanti Security Advisory vom 2025-02-11
https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs