Reflected XSS Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure
CVE-2024-11004

6.1MEDIUM

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
12 November 2024

What is CVE-2024-11004?

A reflected XSS vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure, where an unauthenticated remote attacker can exploit the flaw to gain administrative control. The attack requires user interaction, thereby posing a significant risk to users who may unknowingly interact with a malicious link crafted by an attacker.

Affected Version(s)

Connect Secure 22.7R2.1

Policy Secure 22.7R1.1

References

https://forums.ivanti.com/s/article/Security-Advisory-Iva...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.