Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

🗓️ 13 Nov 2024 12:38:13Reported by NCSCType

Ivanti fixed DoS, XSS, privilege escalation, and remote code execution flaws in Connect Secure and Policy Secure.

Reporter	Title	Published	Views	Family All 188
BDU FSTEC	The vulnerability of Ivanti Connect Secure and Ivanti Policy Secure, which are network access control tools, stems from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary code.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the network control tools Ivanti Connect Secure (previously Pulse Connect Secure) and Ivanti Policy Secure access, related to incorrect processing of input data, allows a perpetrator to execute arbitrary code.	26 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.	4 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.	4 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.	4 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.	4 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.	4 Dec 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure network access control tools arises from the improper assignment of permissions for critical resources. This allows attackers to increase their privileges.	10 Feb 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Connect Secure and Ivanti Policy Secure access control tools lies in the lack of measures taken to protect the website structure. This allows attackers to enhance their privileges and perform cross-site scripting attacks.	14 Feb 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the IPSec component of the Ivanti Connect Secure network access control tool allows a hacker to trigger a service failure.	5 Mar 202500:00	–	bdu_fstec

Vulners

Node

ivanti connect_secureMatch22.6r1

ivanti connect_secureMatch22.7r2.0

ivanti connect_secureMatch22.7r2.1

ivanti connect_secureMatch22.7r2.2

ivanti connect_secureMatch22.7r2.3

ivanti connect_secureMatch22.7r2

ivanti policy_secureMatch22.6r1

ivanti policy_secureMatch22.7r1.1

ivanti policy_secureMatch22.7r2

Source	Link
forums	www.forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

13 Nov 2024 12:38Current

7.5High risk

Vulners AI Score7.5

CVSS 3.18.8 - 9.1

CVSS 39.1

EPSS0.22172

SSVC