PT-2022-22661 · Ivanti · Ivanti Policy Secure+2

Published 2022-12-05 · Updated 2024-02-27 · CVE-2022-35254

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 9.1R14.3 Ivanti Connect Secure versions prior to 9.1R15.2 Ivanti Connect Secure versions prior to 9.1R16.2 Ivanti Connect Secure versions prior to 22.2R4 Ivanti Policy Secure versions prior to 9.1R17 Ivanti Policy Secure versions prior to 22.3R1 Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1

Description An unauthenticated attacker can cause a denial-of-service.

Recommendations For Ivanti Connect Secure versions prior to 9.1R14.3, update to version 9.1R14.3 or later. For Ivanti Connect Secure versions prior to 9.1R15.2, update to version 9.1R15.2 or later. For Ivanti Connect Secure versions prior to 9.1R16.2, update to version 9.1R16.2 or later. For Ivanti Connect Secure versions prior to 22.2R4, update to version 22.2R4 or later. For Ivanti Policy Secure versions prior to 9.1R17, update to version 9.1R17 or later. For Ivanti Policy Secure versions prior to 22.3R1, update to version 22.3R1 or later. For Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1, update to version 22.3R1 or later.

Fix

DoS

Resource Exhaustion

Use After Free

Weakness Enumeration

CWE-400

CWE-416

Related Identifiers

CVE-2022-35254

Affected Products

Ivanti Connect Secure

Ivanti Neurons For Zero-Trust Access

Ivanti Policy Secure

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-35254 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35254 · Vendor Advisory
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW · Note
• https://t.me/cibsecurity/54026 · Telegram Post