CVE-2023-41720: High severity ivanti pulse connect secure vulnerability

Published Dec 14, 2023

Updated

A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure (ICS) appliance can escalate their privileges by exploiting a vulnerable installed application. This vulnerability allows the attacker to gain elevated execution privileges on the affected system.

Affected Software

12 affected components

Ivanti Connect Secure=22.1-r1

Ivanti Connect Secure=22.1-r6

Ivanti Connect Secure=22.2

Ivanti Connect Secure=22.2-r1

Ivanti Connect Secure=22.3-r1

Ivanti Connect Secure=22.4-r1

Ivanti Connect Secure=22.4-r2.1

Ivanti Connect Secure=22.4-r2.2

Ivanti Connect Secure=22.5-r1.1

Ivanti Connect Secure=22.5-r2.1

Ivanti Connect Secure=22.6

Ivanti Connect Secure=22.6-r1

Event History

Dec 14, 2023

CVE Published

01:56 AM

Data Sourced

01:56 AM

DescriptionSeverity

Frequently Asked Questions

What is the severity of CVE-2023-41720?

CVE-2023-41720 is a high severity vulnerability that allows privilege escalation on Ivanti Connect Secure appliances.

How do I fix CVE-2023-41720?

To fix CVE-2023-41720, upgrade Ivanti Connect Secure to version 22.6R2 or later as specified by Ivanti's security patch.

Which versions of Ivanti Connect Secure are affected by CVE-2023-41720?

CVE-2023-41720 affects all versions of Ivanti Connect Secure below 22.6R2.

Can CVE-2023-41720 be exploited remotely?

CVE-2023-41720 requires an attacker to have a foothold on the Ivanti Connect Secure appliance for exploitation.

What type of vulnerability is CVE-2023-41720 classified as?

CVE-2023-41720 is classified as a privilege escalation vulnerability.