6.6

CVE-2025-0293

CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Data is provided by the National Vulnerability Database (NVD)
Ivanti ≫ Connect Secure Version < 22.7
Ivanti ≫ Connect Secure Version22.7 Update-
Ivanti ≫ Connect Secure Version22.7 Updater1
Ivanti ≫ Connect Secure Version22.7 Updater1.1
Ivanti ≫ Connect Secure Version22.7 Updater1.2
Ivanti ≫ Connect Secure Version22.7 Updater1.3
Ivanti ≫ Connect Secure Version22.7 Updater1.4
Ivanti ≫ Connect Secure Version22.7 Updater1.5
Ivanti ≫ Connect Secure Version22.7 Updater2
Ivanti ≫ Connect Secure Version22.7 Updater2.1
Ivanti ≫ Connect Secure Version22.7 Updater2.2
Ivanti ≫ Connect Secure Version22.7 Updater2.3
Ivanti ≫ Connect Secure Version22.7 Updater2.4
Ivanti ≫ Connect Secure Version22.7 Updater2.5
Ivanti ≫ Connect Secure Version22.7 Updater2.6
Ivanti ≫ Connect Secure Version22.7 Updater2.7
Ivanti ≫ Policy Secure Version < 22.7
Ivanti ≫ Policy Secure Version22.7 Update-
Ivanti ≫ Policy Secure Version22.7 Updater1
Ivanti ≫ Policy Secure Version22.7 Updater1.1
Ivanti ≫ Policy Secure Version22.7 Updater1.2
Ivanti ≫ Policy Secure Version22.7 Updater1.3
Ivanti ≫ Policy Secure Version22.7 Updater1.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.126
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
3c1d8aa1-5a33-4ea4-8992-aadd6440af75 6.6 2.3 3.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.