Lucene search
HistoryJan 12, 2024 - 5:15 p.m.
CVE-2023-46805
ivanti
authentication bypass
web component
remote attacker
restricted resources
control checks
CVSS3
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
AI Score
9.1
Confidence
High
EPSS
0.957
Percentile
99.5%
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Affected configurations
Node
ivanticonnect_secureMatch9.0
ORivanticonnect_secureMatch9.1r1
ORivanticonnect_secureMatch9.1r10
ORivanticonnect_secureMatch9.1r11
ORivanticonnect_secureMatch9.1r11.3
ORivanticonnect_secureMatch9.1r11.4
ORivanticonnect_secureMatch9.1r11.5
ORivanticonnect_secureMatch9.1r12
ORivanticonnect_secureMatch9.1r12.1
ORivanticonnect_secureMatch9.1r13
ORivanticonnect_secureMatch9.1r13.1
ORivanticonnect_secureMatch9.1r14
ORivanticonnect_secureMatch9.1r15
ORivanticonnect_secureMatch9.1r15.2
ORivanticonnect_secureMatch9.1r16
ORivanticonnect_secureMatch9.1r16.1
ORivanticonnect_secureMatch9.1r17
ORivanticonnect_secureMatch9.1r17.1
ORivanticonnect_secureMatch9.1r18
ORivanticonnect_secureMatch9.1r2
ORivanticonnect_secureMatch9.1r3
ORivanticonnect_secureMatch9.1r4
ORivanticonnect_secureMatch9.1r4.1
ORivanticonnect_secureMatch9.1r4.2
ORivanticonnect_secureMatch9.1r4.3
ORivanticonnect_secureMatch9.1r5
ORivanticonnect_secureMatch9.1r6
ORivanticonnect_secureMatch9.1r7
ORivanticonnect_secureMatch9.1r8
ORivanticonnect_secureMatch9.1r8.1
ORivanticonnect_secureMatch9.1r8.2
ORivanticonnect_secureMatch9.1r9
ORivanticonnect_secureMatch9.1r9.1
ORivanticonnect_secureMatch22.1r1
ORivanticonnect_secureMatch22.1r6
ORivanticonnect_secureMatch22.2-
ORivanticonnect_secureMatch22.2r1
ORivanticonnect_secureMatch22.3r1
ORivanticonnect_secureMatch22.4r1
ORivanticonnect_secureMatch22.4r2.1
ORivanticonnect_secureMatch22.5r2.1
ORivanticonnect_secureMatch22.6-
ORivanticonnect_secureMatch22.6r1
ORivanticonnect_secureMatch22.6r2
ORivantipolicy_secureMatch9.0
ORivantipolicy_secureMatch9.1r1
ORivantipolicy_secureMatch9.1r10
ORivantipolicy_secureMatch9.1r11
ORivantipolicy_secureMatch9.1r12
ORivantipolicy_secureMatch9.1r13
ORivantipolicy_secureMatch9.1r13.1
ORivantipolicy_secureMatch9.1r14
ORivantipolicy_secureMatch9.1r15
ORivantipolicy_secureMatch9.1r16
ORivantipolicy_secureMatch9.1r17
ORivantipolicy_secureMatch9.1r18
ORivantipolicy_secureMatch9.1r2
ORivantipolicy_secureMatch9.1r3
ORivantipolicy_secureMatch9.1r3.1
ORivantipolicy_secureMatch9.1r4
ORivantipolicy_secureMatch9.1r4.1
ORivantipolicy_secureMatch9.1r4.2
ORivantipolicy_secureMatch9.1r5
ORivantipolicy_secureMatch9.1r6
ORivantipolicy_secureMatch9.1r7
ORivantipolicy_secureMatch9.1r8
ORivantipolicy_secureMatch9.1r8.1
ORivantipolicy_secureMatch9.1r8.2
ORivantipolicy_secureMatch9.1r9
ORivantipolicy_secureMatch22.1r1
ORivantipolicy_secureMatch22.1r6
ORivantipolicy_secureMatch22.2r1
ORivantipolicy_secureMatch22.2r3
ORivantipolicy_secureMatch22.3r1
ORivantipolicy_secureMatch22.3r3
ORivantipolicy_secureMatch22.4r1
ORivantipolicy_secureMatch22.4r2
ORivantipolicy_secureMatch22.4r2.1
ORivantipolicy_secureMatch22.5r1
ORivantipolicy_secureMatch22.5r2.1
ORivantipolicy_secureMatch22.6r1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:*:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:* |
| ivanti | connect_secure | 9.1 | cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:* |
Related
githubexploit
githubexploit
Exploit for Improper Authentication in Ivanti Connect Secure
2024-01-16 08:05:58
Exploit for Improper Authentication in Ivanti Connect Secure
2024-01-19 02:23:13
Exploit for Improper Authentication in Ivanti Connect Secure
2024-01-25 14:53:16
nessus
nessus
Ivanti Connect Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)
2024-02-02 00:00:00
Ivanti Policy Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)
2024-02-02 00:00:00
Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities
2024-01-10 00:00:00
prion
prion
Authentication flaw
2024-01-12 17:15:00
cvelist
cvelist
CVE-2023-46805
2024-01-12 17:02:16
cve
cve
CVE-2023-46805
2024-01-12 17:15:09
qualysblog
qualysblog
Dual Zero-Day Threats in Ivanti Connect Secure and Policy Secure Gateways – CVE-2023-46805 and CVE-2024-21887
2024-01-11 21:54:24
2024 Midyear Threat Landscape Review
2024-08-06 13:00:00
talosblog
talosblog
saint
saint
thn
thn
Chinese Hackers Exploit Zero-Day Flaws in Ivanti Connect Secure and Policy Secure
2024-01-11 05:29:00
Hackers Exploiting Ivanti VPN Flaws to Deploy KrustyLoader Malware
2024-01-31 07:23:00
packetstorm
packetstorm
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-01-22 00:00:00
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-02-21 00:00:00
cisa_kev
cisa_kev
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
2024-01-10 00:00:00
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
2024-01-10 00:00:00
zdt
zdt
Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit
2024-01-22 00:00:00
Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit
2024-02-21 00:00:00
metasploit
metasploit
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-01-16 14:32:48
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-02-06 11:49:04
malwarebytes
malwarebytes
Act now! Ivanti vulnerabilities are being actively exploited
2024-01-11 20:13:16
Ivanti vulnerabilities now actively exploited in massive numbers
2024-01-17 11:18:03
Ivanti urges customers to patch yet another critical vulnerability
2024-02-09 18:13:42
nuclei
nuclei
Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection
2024-01-16 20:53:45
Ivanti ICS - Authentication Bypass
2024-01-16 18:36:55
attackerkb
attackerkb
hivepro
hivepro
Two Zero-Day Flaws Found in Ivanti Connect Secure and Policy Secure
2024-01-12 07:43:30
Ivanti Gateways Under Attack by Cybercriminals Patch Now
2024-03-01 15:08:13
akamaiblog
akamaiblog
wizblog
wizblog
ics
ics
rapid7blog
rapid7blog
Zero-Day Exploitation of Ivanti Connect Secure and Policy Secure Gateways
2024-01-11 13:00:40
Metasploit Weekly Wrap-Up 01/26/24
2024-01-26 21:12:17
avleonov
avleonov
CVSS3
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
AI Score
9.1
Confidence
High
EPSS
0.957
Percentile
99.5%
Related for NVD:CVE-2023-46805