PT-2022-22663 · Ivanti · Ivanti Policy Secure+2

Published 2022-12-05 · Updated 2024-02-27 · CVE-2022-35258

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure (ICS) versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4 Ivanti Policy Secure (IPS) versions prior to 9.1R17 and 22.3R1 Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1

Description An unauthenticated attacker can cause a denial-of-service. The issue affects multiple Ivanti products.

Recommendations For Ivanti Connect Secure (ICS) versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, update to version 9.1R14.3, 9.1R15.2, 9.1R16.2, or 22.2R4 or later. For Ivanti Policy Secure (IPS) versions prior to 9.1R17 and 22.3R1, update to version 9.1R17 or 22.3R1 or later. For Ivanti Neurons for Zero-Trust Access versions prior to 22.3R1, update to version 22.3R1 or later.

Fix

DoS

Weakness Enumeration

CWE-128

CWE-682

Related Identifiers

CVE-2022-35258

Affected Products

Ivanti Connect Secure

Ivanti Neurons For Zero-Trust Access

Ivanti Policy Secure

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-35258 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35258 · Vendor Advisory
• https://t.me/cvenotify/39514 · Telegram Post
• https://t.me/cibsecurity/54028 · Telegram Post
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW · Note