Description
A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Connect Secure | 22.7R2 – < 22.7R2, 22.5R2.2 – < 22.5R2.2, 9.1R18.6 – < 9.1R18.6 | 22.7R2 |
Advisories 1
- WID-SEC-2024-1201 Ivanti Connect Secure: Schwachstelle ermöglicht Cross-Site Scripting BSI CERT-Bund (WID) · May 21, 2024