PT-2025-6240 · Ivanti · Ivanti Policy Secure+1

Published 2025-02-11 · Updated 2025-02-11 · CVE-2024-13830

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.6 Ivanti Policy Secure versions prior to 22.7R1.3

Description: The issue allows a remote unauthenticated attacker to obtain admin privileges. It requires user interaction.

Recommendations: For Ivanti Connect Secure versions prior to 22.7R2.6, update to version 22.7R2.6 or later. For Ivanti Policy Secure versions prior to 22.7R1.3, update to version 22.7R1.3 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-05393

CVE-2024-13830

Affected Products

Ivanti Connect Secure

Ivanti Policy Secure

References · 6

• https://bdu.fstec.ru/vul/2025-05393 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13830 · Vendor Advisory
• https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13830 · Security Note
• https://twitter.com/CVEnew/status/1889341255416762491 · Twitter Post
• https://vuldb.com/ru/?id.295261 · Note