SSRF Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure
CVE-2025-0292

5.5MEDIUM

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
8 July 2025

What is CVE-2025-0292?

A Server-Side Request Forgery (SSRF) vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure prior to specified versions. This flaw allows a remote attacker who has administrative privileges to manipulate the application into sending unauthorized requests to internal network services. If exploited, this vulnerability could lead to unauthorized access to sensitive internal resources, posing a significant risk to organizational security.

Affected Version(s)

Connect Secure 22.7R2.8

Policy Secure 22.7R1.5

References

https://forums.ivanti.com/s/article/July-Security-Advisor...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-0292 : SSRF Vulnerability in Ivanti Connect Secure and Ivanti Policy Secure