CVE-2023-38043

Published: Nov 15, 2023Modified: Nov 21, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine and, in some cases, resulting in a full compromise of the system.

Affected (2)

Products: Ivanti: Secure Access Client

1 product

Secure Access Client

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ivanti Secure Access Client	Before 22.6
Ivanti Secure Access Client	Version 22.6 r1

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (4)

https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release

Source: support@hackerone.com

Vendor Advisory

https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client

Source: support@hackerone.com

https://forums.ivanti.com/s/article/Security-fixes-included-in-the-latest-Ivanti-Secure-Access-Client-Release

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://northwave-cybersecurity.com/vulnerability-notice/arbitrary-kernel-function-call-in-ivanti-secure-access-client

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.