PT-2025-36747 · Ivanti · Ivanti Connect Secure+3
CVE-2025-55142
·
Publicado
2025-09-09
·
Atualizado
2025-09-24
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Ivanti Connect Secure versions prior to 22.7R2.9
Ivanti Policy Secure versions prior to 22.7R1.6
Ivanti ZTA Gateway versions prior to 2.8R2.3-723
Ivanti Neurons for Secure Access versions prior to 22.8R1.4
Description:
A missing authorization check allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
Recommendations:
Ivanti Connect Secure: Update to version 22.7R2.9 or later.
Ivanti Policy Secure: Update to version 22.7R1.6 or later.
Ivanti ZTA Gateway: Update to version 2.8R2.3-723 or later.
Ivanti Neurons for Secure Access: Update to version 22.8R1.4 or later.
Correção
LPE
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ivanti Connect Secure
Ivanti Neurons For Secure Access
Ivanti Policy Secure
Ivanti Zta Gateways