PT-2023-26263 · Ivanti · Ivanti Secure Access Client

Alex Oudenaarden + 1 · Publicado 2023-11-14 · Atualizado 2024-08-12 · CVE-2023-38043

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Secure Access Client versions prior to 22.6R1.1

Description A vulnerability exists in the Ivanti Secure Access Client, which could allow a locally authenticated attacker to exploit a vulnerable configuration. This could potentially lead to a denial of service (DoS) condition on the user machine and, in some cases, result in a full compromise of the system.

Recommendations For versions prior to 22.6R1.1, update to version 22.6R1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to vulnerable configurations until a patch is applied.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-38043

Produtos afetados

Ivanti Secure Access Client

Referências · 8

• https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client · Nota
• https://osv.dev/vulnerability/CVE-2023-38043 · Aviso do Fabricante
• https://twitter.com/cyber_hack5/status/1799135748924301493 · Publicação no Twitter
• https://t.me/cvenotify/90106 · Publicação no Telegram
• https://twitter.com/CoreSecurity/status/1747382582935736459 · Publicação no Twitter
• https://twitter.com/tijme/status/1756662758144192560 · Publicação no Twitter
• https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-38043 · Nota de Segurança