PT-2023-26263 · Ivanti · Ivanti Secure Access Client

Alex Oudenaarden + 1 · CVE-2023-38043 · Published 2023-11-14 · Updated 2024-08-12

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Secure Access Client versions prior to 22.6R1.1

Description A vulnerability exists in the Ivanti Secure Access Client, which could allow a locally authenticated attacker to exploit a vulnerable configuration. This could potentially lead to a denial of service (DoS) condition on the user machine and, in some cases, result in a full compromise of the system.

Recommendations For versions prior to 22.6R1.1, update to version 22.6R1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to vulnerable configurations until a patch is applied.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-38043

Affected Products

Ivanti Secure Access Client

References · 8

• https://osv.dev/vulnerability/CVE-2023-38043 · Vendor Advisory
• https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38043 · Security Note
• https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client · Note
• https://twitter.com/cyber_hack5/status/1799135748924301493 · Twitter Post
• https://t.me/cvenotify/90106 · Telegram Post
• https://twitter.com/CoreSecurity/status/1747382582935736459 · Twitter Post
• https://twitter.com/tijme/status/1756662758144192560 · Twitter Post