CVE-2022-35254
05.12.2022, 22:15
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect_secure | 𝑥 < 9.1 |
| ivanti | connect_secure | 9.1 |
| ivanti | connect_secure | 9.1:r1 |
| ivanti | connect_secure | 9.1:r1.0 |
| ivanti | connect_secure | 9.1:r10.0 |
| ivanti | connect_secure | 9.1:r10.2 |
| ivanti | connect_secure | 9.1:r11.0 |
| ivanti | connect_secure | 9.1:r11.1 |
| ivanti | connect_secure | 9.1:r11.3 |
| ivanti | connect_secure | 9.1:r11.4 |
| ivanti | connect_secure | 9.1:r11.5 |
| ivanti | connect_secure | 9.1:r12 |
| ivanti | connect_secure | 9.1:r12.1 |
| ivanti | connect_secure | 9.1:r12.2 |
| ivanti | connect_secure | 9.1:r13 |
| ivanti | connect_secure | 9.1:r13.1 |
| ivanti | connect_secure | 9.1:r14 |
| ivanti | connect_secure | 9.1:r15 |
| ivanti | connect_secure | 9.1:r16 |
| ivanti | connect_secure | 9.1:r16.1 |
| ivanti | connect_secure | 9.1:r2 |
| ivanti | connect_secure | 9.1:r2.0 |
| ivanti | connect_secure | 9.1:r3 |
| ivanti | connect_secure | 9.1:r3.0 |
| ivanti | connect_secure | 9.1:r4 |
| ivanti | connect_secure | 9.1:r4.0 |
| ivanti | connect_secure | 9.1:r4.1 |
| ivanti | connect_secure | 9.1:r4.2 |
| ivanti | connect_secure | 9.1:r4.3 |
| ivanti | connect_secure | 9.1:r5 |
| ivanti | connect_secure | 9.1:r5.0 |
| ivanti | connect_secure | 9.1:r6 |
| ivanti | connect_secure | 9.1:r6.0 |
| ivanti | connect_secure | 9.1:r7 |
| ivanti | connect_secure | 9.1:r7.0 |
| ivanti | connect_secure | 9.1:r8 |
| ivanti | connect_secure | 9.1:r8.0 |
| ivanti | connect_secure | 9.1:r8.1 |
| ivanti | connect_secure | 9.1:r8.2 |
| ivanti | connect_secure | 9.1:r8.4 |
| ivanti | connect_secure | 9.1:r9 |
| ivanti | connect_secure | 9.1:r9.0 |
| ivanti | connect_secure | 9.1:r9.1 |
| ivanti | connect_secure | 9.1:r9.2 |
| ivanti | connect_secure | 21.9:r1 |
| ivanti | connect_secure | 21.12:r1 |
| ivanti | connect_secure | 22.1:r1 |
| ivanti | connect_secure | 22.2 |
| ivanti | connect_secure | 22.2:r1 |
| ivanti | neurons_for_zero-trust_access | 22.2:r1 |
| ivanti | policy_secure | 𝑥 < 9.1 |
| ivanti | policy_secure | 9.1 |
| ivanti | policy_secure | 9.1:r1 |
| ivanti | policy_secure | 9.1:r10 |
| ivanti | policy_secure | 9.1:r11 |
| ivanti | policy_secure | 9.1:r12 |
| ivanti | policy_secure | 9.1:r13 |
| ivanti | policy_secure | 9.1:r13.1 |
| ivanti | policy_secure | 9.1:r14 |
| ivanti | policy_secure | 9.1:r15 |
| ivanti | policy_secure | 9.1:r16 |
| ivanti | policy_secure | 9.1:r2 |
| ivanti | policy_secure | 9.1:r3 |
| ivanti | policy_secure | 9.1:r3.1 |
| ivanti | policy_secure | 9.1:r4 |
| ivanti | policy_secure | 9.1:r4.1 |
| ivanti | policy_secure | 9.1:r4.2 |
| ivanti | policy_secure | 9.1:r5 |
| ivanti | policy_secure | 9.1:r6 |
| ivanti | policy_secure | 9.1:r7 |
| ivanti | policy_secure | 9.1:r8 |
| ivanti | policy_secure | 9.1:r8.1 |
| ivanti | policy_secure | 9.1:r8.2 |
| ivanti | policy_secure | 9.1:r9 |
| ivanti | policy_secure | 22.1:r1 |
| ivanti | policy_secure | 22.2:r1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-416 - Use After FreeReferencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.