Vulnerability · Published Nov 14, 2023 · Assigned by hackerone
CVE-2023-35080
High 8.8
In plain English
A high-severity incorrect default permissions in Secure Access Client from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Secure Access Client | 22.6.1.1 – before 22.6.1.1 |
Weakness: CWE-276 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H