COOEY // HUBcompliance · community · intelligence

Exposures › CVE-2023-46805

CVE-2023-46805

Severity
critical · on CISA KEV actively exploited
Source
CISA-KEV · kev
Published
2024-01-10
Reference
https://nvd.nist.gov/vuln/detail/CVE-2023-46805
⚡ RCE ◐ zero-day ⌖ exploited in the wild shame 95/100 ransomwarerceexploited-in-wildzero-day

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be

Players implicated

Ivanti · vendorConnect Secure and Policy Secure · product

Description

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability.

Affected FedRAMP products 2 in the catalog

ProductProviderStatusMatch
Ivanti Neurons for ITSM (Formerly Service Manager) Ivanti Authorized vendor-exact · 0.90
Ivanti Neurons for MDM (Formerly MobileIron) Ivanti Authorized vendor-exact · 0.90