Ivanti Connect Secure

CVE-2023-38551

HIGH 8.2

En bref

Source: NVD
EPSS: EPSS 1.00 % · centile 63 (2026-10-31)
État: PUBLISHED
Publiée: 2024-05-31 17:38 UTC
Mise à jour: 2025-03-27 20:43 UTC
Attribuée par: hackerone
Statut NVD: Deferred

Rechercher sur…

Description

A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack.

Faiblesses (CWE)

CWE-93 — Injection CRLF

Références

https://forums.ivanti.com/s/article/Security-Advisory-May-2024

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.0	HIGH 8.2	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H	hackerone
CVSS 3.0	HIGH 8.2	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H	NVD · support@hackerone.com (Secondary)

Références européennes

ENISA EUVD · EUVD-2023-42350
GCVE · GCVE-0-2023-38551

Avis du CERT-FR

CERTFR-2024-AVI-0434 — Multiples vulnérabilités dans les produits Ivanti · cert.ssi.gouv.fr

Produits affectés

Produit	Versions
Ivanti · Connect Secure	affected 22.7R2 < 22.7R2 ; affected 22.5R2.2 < 22.5R2.2 ; affected 9.1R18.6 < 9.1R18.6

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD