Reflected XSS Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure
CVE-2024-13830

6.1MEDIUM

Key Information:

Vendor
Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
11 February 2025

Summary

A reflected cross-site scripting vulnerability exists in the Ivanti Connect Secure and Ivanti Policy Secure products prior to specified versions. This vulnerability could allow a remote unauthenticated attacker to leverage it to obtain administrative privileges, provided that user interaction takes place. It is essential for users to implement necessary precautions and apply the recommended updates to safeguard against potential exploitation.

Affected Version(s)

Connect Secure 22.7R2.6

Policy Secure 22.7R1.3

References

https://forums.ivanti.com/s/article/February-Security-Adv...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.