medium6.0

CVE-2024-13842

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with ad…

Impact

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

Affected products

Vendor	Product	Affected versions
Ivanti	Connect Secure	through 22.7 Version 22.7
Ivanti	Policy Secure	through 22.7 Version 22.7

Weakness classification

CWE-321

References

NVD record
CVE.org record
https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs