Lucene search

HackeroneCVE-2023-38041

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-38041

2023-10-2518:17:28

CWE-367

hackerone

web.nvd.nist.gov

cve-2023-38041

toctou

permissions

race condition

nvd

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.

Affected configurations

Nvd

Vulners

Node

ivantisecure_access_clientRange<22.6

AND

microsoftwindowsMatch-

VendorProductVersionCPE
ivantisecure_access_client*cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ivanti	secure_access_client	*	cpe:2.3:a:ivanti:secure_access_client::::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Secure Access Client",
    "versions": [
      {
        "version": "22.6R1",
        "status": "affected",
        "lessThan": "22.6R1",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Related for CVE-2023-38041