High Β· published January 31, 2024
CVSS calls it high at 8.2. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
π¨ An attacker only needs to craft a specific request to gain unauthorized access to restricted resources in Ivanti Connect Secure and Policy Secure! β‘ Think of it like a sneaky delivery person who knows how to trick the receptionist into handing over the keys to the restricted areas of a building, bypassing the security checks entirely. An attacker can exploit this vulnerability to access sensitive information or restricted resources without ever needing to authenticate, exposing critical data to unauthorized users. The potential for data breaches and unauthorized actions can lead to devastating consequences for your organization.
Think of it like a sneaky delivery person who knows how to trick the receptionist into handing over the keys to the restricted areas of a building, bypassing the security checks entirely. This server-side request forgery (SSRF) vulnerability in the SAML component allows attackers to send crafted requests that can access protected resources without proper authentication checks.
An attacker can exploit this vulnerability to access sensitive information or restricted resources without ever needing to authenticate, exposing critical data to unauthorized users. The potential for data breaches and unauthorized actions can lead to devastating consequences for your organization. Immediately patch your Ivanti Connect Secure and Policy Secure to versions 9.x and 22.x, which contain the fix for this vulnerability. Additionally, review your security configurations to ensure that such unauthorized access is not possible in the future. You've got this! By taking these steps, you can protect your systems and keep your data safe! π‘οΈ
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/connect_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/policy_secure | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |
| ivanti/neurons_for_zero-trust_access | all versions | β |