Lucene search

HackeroneCVE-2023-39340

HistoryDec 16, 2023 - 2:15 a.m.

CVE-2023-39340

2023-12-1602:15:07

hackerone

web.nvd.nist.gov

cve-2023-39340

ivanti connect secure

dos

vulnerability

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to Denial of Service (DoS) of the appliance.

Affected configurations

Nvd

Vulners

Node

ivanticonnect_secureMatch22.1r1

ivanticonnect_secureMatch22.1r6

ivanticonnect_secureMatch22.2-

ivanticonnect_secureMatch22.2r1

ivanticonnect_secureMatch22.3r1

ivanticonnect_secureMatch22.4r1

ivanticonnect_secureMatch22.4r2.1

ivanticonnect_secureMatch22.5r2.1

Node

ivanticonnect_secureMatch9.1r1

ivanticonnect_secureMatch9.1r1.0

ivanticonnect_secureMatch9.1r10

ivanticonnect_secureMatch9.1r10.0

ivanticonnect_secureMatch9.1r10.2

ivanticonnect_secureMatch9.1r11

ivanticonnect_secureMatch9.1r11.0

ivanticonnect_secureMatch9.1r11.1

ivanticonnect_secureMatch9.1r11.3

ivanticonnect_secureMatch9.1r11.4

ivanticonnect_secureMatch9.1r11.5

ivanticonnect_secureMatch9.1r12

ivanticonnect_secureMatch9.1r12.1

ivanticonnect_secureMatch9.1r12.2

ivanticonnect_secureMatch9.1r13

ivanticonnect_secureMatch9.1r13.1

ivanticonnect_secureMatch9.1r14

ivanticonnect_secureMatch9.1r14.4

ivanticonnect_secureMatch9.1r15

ivanticonnect_secureMatch9.1r15.2

ivanticonnect_secureMatch9.1r16

ivanticonnect_secureMatch9.1r16.1

ivanticonnect_secureMatch9.1r17

ivanticonnect_secureMatch9.1r17.1

ivanticonnect_secureMatch9.1r17.2

ivanticonnect_secureMatch9.1r18

ivanticonnect_secureMatch9.1r18.1

ivanticonnect_secureMatch9.1r2

ivanticonnect_secureMatch9.1r2.0

ivanticonnect_secureMatch9.1r3

ivanticonnect_secureMatch9.1r3.0

ivanticonnect_secureMatch9.1r4

ivanticonnect_secureMatch9.1r4.0

ivanticonnect_secureMatch9.1r4.1

ivanticonnect_secureMatch9.1r4.2

ivanticonnect_secureMatch9.1r4.3

ivanticonnect_secureMatch9.1r5

ivanticonnect_secureMatch9.1r5.0

ivanticonnect_secureMatch9.1r6

ivanticonnect_secureMatch9.1r6.0

ivanticonnect_secureMatch9.1r7

ivanticonnect_secureMatch9.1r7.0

ivanticonnect_secureMatch9.1r8

ivanticonnect_secureMatch9.1r8.0

ivanticonnect_secureMatch9.1r8.1

ivanticonnect_secureMatch9.1r8.2

ivanticonnect_secureMatch9.1r8.4

ivanticonnect_secureMatch9.1r9

ivanticonnect_secureMatch9.1r9.0

ivanticonnect_secureMatch9.1r9.1

Node

ivanticonnect_secureMatch22.6-

ivanticonnect_secureMatch22.6r1

VendorProductVersionCPE
ivanticonnect_secure22.1cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*
ivanticonnect_secure22.1cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*
ivanticonnect_secure22.2cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*
ivanticonnect_secure22.2cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*
ivanticonnect_secure22.3cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*
ivanticonnect_secure22.4cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*
ivanticonnect_secure22.4cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*
ivanticonnect_secure22.5cpe:2.3:a:ivanti:connect_secure:22.5:r2.1:*:*:*:*:*:*
ivanticonnect_secure9.1cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
ivanticonnect_secure9.1cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*

Vendor	Product	Version	CPE
ivanti	connect_secure	22.1	cpe:2.3:a:ivanti:connect_secure:22.1:r1::::::
ivanti	connect_secure	22.1	cpe:2.3:a:ivanti:connect_secure:22.1:r6::::::
ivanti	connect_secure	22.2	cpe:2.3:a:ivanti:connect_secure:22.2:-::::::
ivanti	connect_secure	22.2	cpe:2.3:a:ivanti:connect_secure:22.2:r1::::::
ivanti	connect_secure	22.3	cpe:2.3:a:ivanti:connect_secure:22.3:r1::::::
ivanti	connect_secure	22.4	cpe:2.3:a:ivanti:connect_secure:22.4:r1::::::
ivanti	connect_secure	22.4	cpe:2.3:a:ivanti:connect_secure:22.4:r2.1::::::
ivanti	connect_secure	22.5	cpe:2.3:a:ivanti:connect_secure:22.5:r2.1::::::
ivanti	connect_secure	9.1	cpe:2.3:a:ivanti:connect_secure:9.1:r1::::::
ivanti	connect_secure	9.1	cpe:2.3:a:ivanti:connect_secure:9.1:r1.0::::::

Rows per page:

1-10 of 601

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Connect Secure",
    "versions": [
      {
        "version": "22.6.1",
        "status": "affected",
        "lessThan": "22.6.1",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/Security-fix-release-Ivanti-Connect-Secure-22-6R2-and-22-6R2-1?language=en_US

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2023-39340