CVE-2023-46805

Published Jan 12, 2024

Last updated 4 months ago

Overview

Description
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Source
support@hackerone.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
8.2
Impact score
4.2
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity
HIGH

CVSS 3.0

Type
Secondary
Base score
8.2
Impact score
4.2
Exploitability score
3.9
Vector string
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity
HIGH

Known exploits

Data from CISA

Vulnerability name
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Exploit added on
Jan 10, 2024
Exploit action due
Jan 22, 2024
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-287

Social media

Hype score
Not currently trending
  1. نسخه جدید باج افزار DragonForce منتشر شده است که از آسیب پذیری هایی با کدهای شناسایی CVE-2021-44228 و CVE-2023-46805 و CVE-2024-21887 استفاده می کند. برای حفظ دسترسی خود از بدافزاری

    @AmirHossein_sec

    10 May 2025

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    19 Mar 2025

    45 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    16 Mar 2025

    46 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    15 Mar 2025

    53 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    15 Mar 2025

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    10 Mar 2025

    27 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  7. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    10 Mar 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  8. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    9 Mar 2025

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  9. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    7 Mar 2025

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  10. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    5 Mar 2025

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  11. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    4 Mar 2025

    66 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  12. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    3 Mar 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  13. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    2 Mar 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  14. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    1 Mar 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  15. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    28 Feb 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  16. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    28 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  17. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    27 Feb 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  18. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    26 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  19. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    26 Feb 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  20. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    25 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  21. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    25 Feb 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  22. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    23 Feb 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  23. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    22 Feb 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  24. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    22 Feb 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  25. Actively exploited CVE : CVE-2023-46805

    @transilienceai

    21 Feb 2025

    14 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  26. Ivanti Connect SecureのCVE-2025-0282はMandiant曰く24/12/24頃から悪用されており25/1/8にパッチリリース https://t.co/iN0IZfGf0G 去年大騒ぎになった同じくIvanti/Pulse Connect Secure のゼロデイ CVE-2024-21887、CVE-2023-46805も23/12から攻撃があり翌年1/10以降に対策リリース… https://t.co/qp3L0ryDAT

    @nekono_naha

    9 Jan 2025

    1106 Impressions

    4 Retweets

    11 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  27. 私的2024年の悪用があった脆弱性3選。 ・Ivanti Connect Secure の複数の脆弱性(CVE-2023-46805等) ・PAN-OSの脆弱性(CVE-2024-3400) ・FortiManagerの脆弱性(CVE-2024-47575) どれも悪用済からの情報公開でパッチと共にまず侵害有無を調査すべきだが、しなくて侵害に気がついてない組織も多かった。

    @Sec_S_Owl

    19 Dec 2024

    1377 Impressions

    1 Retweet

    25 Likes

    4 Bookmarks

    0 Replies

    0 Quotes

Configurations