Ivanti Secure Access Client < 22.6R1.1 Multiple Vulnerabilities

high Nessus Plugin ID 187131

Language:

Synopsis

A VPN client installed on the remote windows system is affected by multiple vulnerabilities.

Description

The Ivanti Secure Access Client installed on the remote Windows system is prior to 22.6R1.1. It is, therefore, affected by multiple vulnerabilities.

- A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service on the user machine, or information disclosure. (CVE-2023-35080)

- A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine. (CVE-2023-38543)

- A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine and, in some cases, resulting in a full compromise of the system. (CVE-2023-38043)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Ivanti Secure Access Client version 22.3R1.1 or later.

Plugin Details

Severity: High

ID: 187131

File Name: ivanti_secure_access_client_22_6R1_1.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 12/20/2023

Updated: 1/22/2024

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-38543

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7.2

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: x-cpe:/a:ivanti:ivanti_secure_access_client

Required KB Items: installed_sw/Ivanti Secure Access Client

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/9/2023

Vulnerability Publication Date: 11/9/2023

Exploitable With

Core Impact

Reference Information

CVE: CVE-2023-35080, CVE-2023-38043, CVE-2023-38543

Detections

Analytics