PT-2020-9825 · Ivanti · Ivanti Workspace Control

Published 2020-03-19 · Updated 2020-08-24 · CVE-2019-16382

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Workspace Control version 10.3.110.0

Description An issue allows bypassing Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid, enabling the creation of a malicious PowerGrid XML file. After renaming the folder back to its original value, exploitation can be achieved by using PowerGrid with the /SEE parameter to execute an arbitrary command specified in the XML file.

Recommendations For Ivanti Workspace Control version 10.3.110.0, consider restricting access to the PowerGrid XML file and the WMTemp work folder to minimize the risk of exploitation. As a temporary workaround, avoid using the /SEE parameter with PowerGrid until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-16382

Affected Products

Ivanti Workspace Control

References · 4

• https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16382 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16382 · Vendor Advisory
• https://twitter.com/jmoosdijk · Note