PT-2018-17471 · Ivanti · Ivanti Endpoint Security

Published 2018-02-15 · Updated 2019-10-03 · CVE-2018-6316

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Security versions 8.5 Update 1 and earlier

Description The issue allows an authenticated user with low privileges and access to the local network to bypass application whitelisting when using the Application Control module in lockdown mode.

Recommendations For versions 8.5 Update 1 and earlier, update to a version later than 8.5 Update 1 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-6316

Affected Products

Ivanti Endpoint Security

References · 3

• https://osv.dev/vulnerability/CVE-2018-6316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6316 · Security Note
• https://community.ivanti.com/docs/DOC-65656 · Note