PT-2022-18213 · Ivanti · Ivanti Dsm Remote

Florian Hansemann · Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-27088

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti DSM Remote versions prior to 6.3.1.1862

Description The issue allows local users to launch processes with elevated privileges due to an unquoted service path.

Recommendations For versions prior to 6.3.1.1862, update to a version that contains a fix for this issue to prevent local users from launching processes with elevated privileges.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2022-27088

Affected Products

Ivanti Dsm Remote

References · 3

• https://osv.dev/vulnerability/CVE-2022-27088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27088 · Security Note
• https://hansesecure.de/2022/03/schwachstelle-in-dsm-remote · Note