7.2

CVE-2022-21828

Exploit
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Incapptic Connect Version 1.35.3
Ivanti ≫ Incapptic Connect Version 1.35.4
Ivanti ≫ Incapptic Connect Version 1.35.5
Ivanti ≫ Incapptic Connect Version 1.36.0
Ivanti ≫ Incapptic Connect Version 1.37.0
Ivanti ≫ Incapptic Connect Version 1.37.1
Ivanti ≫ Incapptic Connect Version 1.38.0
Ivanti ≫ Incapptic Connect Version 1.38.1
Ivanti ≫ Incapptic Connect Version 1.39.0
Ivanti ≫ Incapptic Connect Version 1.39.1
Ivanti ≫ Incapptic Connect Version 1.40.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.97% 0.894
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://forums.ivanti.com/s/article/SA-2022-02-23?language=en_US
Third Party Advisory
Exploit