Ivanti Connect Secure predictable filenames allow file uploads
Anyone with a login to the company VPN device can upload files!
Summary
Predictable filenames in Ivanti Connect Secure let a remote attacker with a login upload files with content of their choosing to a known location on disk. Versions before 25.1.1.3 and 22.8R2.6 are affected.
Affected when
- attacker has an authenticated account
- Ivanti Connect Secure before 25.1.1.3 or 22.8R2.6
What to do
Update to 25.1.1.3 or 22.8R2.6 or later.
Update to at least the version for your product:
- Ivanti Connect Secure 25.1 25.1.1.3 or later
- Ivanti Connect Secure 22.8R2 22.8R2.6 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen