High Β· published January 12, 2024
CVSS calls it high at 8.2. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
π¨ An authentication bypass leaves your front door wide open! πͺ Remote attackers can access restricted resources in Ivanti ICS versions 9.x and 22.x like a courier who never checks IDs! π₯ Think of it like a restaurant where anyone can walk into the kitchen without a reservation β just because the door was left ajar. This vulnerability lets attackers sneak past security checks, gaining access to sensitive areas they shouldnβt be in. An attacker exploiting this vulnerability can access restricted areas of your system, potentially exposing sensitive data or critical configuration settings. This kind of mishap can lead to unauthorized changes, data leaks, or severe disruptions in service β all absolutely devastating for any organization!
Think of it like a restaurant where anyone can walk into the kitchen without a reservation β just because the door was left ajar. This vulnerability lets attackers sneak past security checks, gaining access to sensitive areas they shouldnβt be in. This flaw allows remote attackers to bypass authentication controls in the web component of Ivanti ICS and Ivanti Policy Secure, granting them access to resources without proper authorization checks.
An attacker exploiting this vulnerability can access restricted areas of your system, potentially exposing sensitive data or critical configuration settings. This kind of mishap can lead to unauthorized changes, data leaks, or severe disruptions in service β all absolutely devastating for any organization! Update to the latest version immediately to patch this vulnerability. Ensure that your security checks are properly configured, and review your access controls for any gaps that could be exploited. Regular audits can also help catch any lurking issues. You've got this! Stay vigilant, follow these steps, and keep your systems secure! π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |