PT-2022-15157 · Ivanti · Ivanti Workspace Control

Published 2022-01-07 · Updated 2022-01-14 · CVE-2022-21823

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Workspace Control versions prior to 2021.2 (10.7.30.0)

Description A vulnerability exists due to insecure storage of sensitive information, potentially allowing an attacker with locally authenticated low privileges to obtain key information.

Recommendations For versions prior to 2021.2 (10.7.30.0), update to version 2021.2 (10.7.30.0) or later to resolve the issue.

Fix

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-922

Related Identifiers

CVE-2022-21823

Affected Products

Ivanti Workspace Control

References · 3

• https://osv.dev/vulnerability/CVE-2022-21823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21823 · Security Note
• https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-obtain-key-information-due-to-an-unspecified-attack-vector?language=en_US · Vendor Advisory