CVE-2023-46805

HIGH8.2Auth bypass

CISA KEVRansomwarePublic PoCHigh EPSS

Description

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

CVSS breakdown

CVSS 3.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected products

Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure22.1 – 22.1
Ivanti / Connect Secure22.1 – 22.1
Ivanti / Connect Secure22.2 – 22.2
Ivanti / Connect Secure22.2 – 22.2
Ivanti / Connect Secure22.3 – 22.3
Ivanti / Connect Secure22.4 – 22.4
Ivanti / Connect Secure22.4 – 22.4
Ivanti / Connect Secure22.5 – 22.5
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.1 – 9.1
Ivanti / ICS9.1R18 – 9.1R18
Ivanti / ICS22.6R2 – 22.6R2
Ivanti / IPS9.1R18 – 9.1R18
Ivanti / IPS22.6R1 – 22.6R1
Ivanti / Policy Secure22.5 – 22.5
Ivanti / Policy Secure22.5 – 22.5
Ivanti / Policy Secure22.6 – 22.6
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure22.1 – 22.1
Ivanti / Policy Secure22.1 – 22.1
Ivanti / Policy Secure22.2 – 22.2
Ivanti / Policy Secure22.2 – 22.2
Ivanti / Policy Secure22.3 – 22.3
Ivanti / Policy Secure22.3 – 22.3
Ivanti / Policy Secure22.4 – 22.4
Ivanti / Policy Secure22.4 – 22.4
Ivanti / Policy Secure22.4 – 22.4

Exploits & proofs of concept

nucleiIvanti ICS - Authentication Bypassby DhiyaneshDK,daffainfo,geeknik

References

MISChttps://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
EXPLOIThttp://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html

Updated 17m ago · 8 sources