CVE-2018-6316

Published: Feb 15, 2018Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

Ivanti Endpoint Security (formerly HEAT Endpoint Management and Security Suite) 8.5 Update 1 and earlier allows an authenticated user with low privileges and access to the local network to bypass application whitelisting when using the Application Control module on Ivanti Endpoint Security in lockdown mode.

Affected (2)

Products: Ivanti: Endpoint Security

1 product

Endpoint Security

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Security	Up to 8.5
Ivanti Endpoint Security	Version 8.5 update_1

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://community.ivanti.com/docs/DOC-65656

Source: cve@mitre.org

Permissions Required

https://community.ivanti.com/docs/DOC-65656

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.