SSRF Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure
CVE-2025-0292

4.9MEDIUM

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
8 July 2025

What is CVE-2025-0292?

A Server-Side Request Forgery (SSRF) vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure prior to specified versions. This flaw allows a remote attacker who has administrative privileges to manipulate the application into sending unauthorized requests to internal network services. If exploited, this vulnerability could lead to unauthorized access to sensitive internal resources, posing a significant risk to organizational security.

Affected Version(s)

Connect Secure 22.7R2.8

Policy Secure 22.7R1.5

References

https://forums.ivanti.com/s/article/July-Security-Advisor...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-0292 : SSRF Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure