CVE-2022-21828

Published: Mar 4, 2022Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.

Affected (11)

Products: Ivanti: Incapptic Connect

Ivanti

1 product

Incapptic Connect

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Ivanti Incapptic Connect	Version 1.35.3
Ivanti Incapptic Connect	Version 1.35.4
Ivanti Incapptic Connect	Version 1.35.5
Ivanti Incapptic Connect	Version 1.36.0
Ivanti Incapptic Connect	Version 1.37.0
Ivanti Incapptic Connect	Version 1.37.1
Ivanti Incapptic Connect	Version 1.38.0
Ivanti Incapptic Connect	Version 1.38.1
Ivanti Incapptic Connect	Version 1.39.0
Ivanti Incapptic Connect	Version 1.39.1
Ivanti Incapptic Connect	Version 1.40.0

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US

Source: support@hackerone.com

ExploitThird Party Advisory

https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.