Vulnerability · Published Jan 7, 2022 · Assigned by hackerone

CVE-2022-21823

Medium 5.5

In plain English

A medium-severity security flaw in Ivanti Workspace Control. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.

Affected products (as reported)

Vendor	Product	Versions
n/a	Ivanti Workspace Control	2021.2 (10.7.30.0)

Weakness: CWE-922

References

https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-obtain-key-information-due-to-an-unspecified-attack-vector?language=en_US x_refsource_MISC