6.1

CVE-2025-55143

Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to inject arbitrary text into a crafted HTTP response. User interaction is required.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Connect Secure Version < 22.7
Ivanti ≫ Connect Secure Version22.7 Update-
Ivanti ≫ Connect Secure Version22.7 Updater1
Ivanti ≫ Connect Secure Version22.7 Updater1.1
Ivanti ≫ Connect Secure Version22.7 Updater1.2
Ivanti ≫ Connect Secure Version22.7 Updater1.3
Ivanti ≫ Connect Secure Version22.7 Updater1.4
Ivanti ≫ Connect Secure Version22.7 Updater1.5
Ivanti ≫ Connect Secure Version22.7 Updater2
Ivanti ≫ Connect Secure Version22.7 Updater2.1
Ivanti ≫ Connect Secure Version22.7 Updater2.2
Ivanti ≫ Connect Secure Version22.7 Updater2.3
Ivanti ≫ Connect Secure Version22.7 Updater2.4
Ivanti ≫ Connect Secure Version22.7 Updater2.5
Ivanti ≫ Connect Secure Version22.7 Updater2.6
Ivanti ≫ Connect Secure Version22.7 Updater2.7
Ivanti ≫ Connect Secure Version22.7 Updater2.8
Ivanti ≫ Policy Secure Version < 22.7
Ivanti ≫ Policy Secure Version22.7 Update-
Ivanti ≫ Policy Secure Version22.7 Updater1
Ivanti ≫ Policy Secure Version22.7 Updater1.1
Ivanti ≫ Policy Secure Version22.7 Updater1.2
Ivanti ≫ Policy Secure Version22.7 Updater1.3
Ivanti ≫ Policy Secure Version22.7 Updater1.4
Ivanti ≫ Policy Secure Version22.7 Updater1.5
Ivanti ≫ Zero Trust Access Gateway Version22.8 Updater2.2
Ivanti ≫ Neurons For Secure Access Version < 22.8
Ivanti ≫ Neurons For Secure Access Version22.8 Updater1
Ivanti ≫ Neurons For Secure Access Version22.8 Updater1.1
Ivanti ≫ Neurons For Secure Access Version22.8 Updater1.2
Ivanti ≫ Neurons For Secure Access Version22.8 Updater1.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.05% 0.143
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
3c1d8aa1-5a33-4ea4-8992-aadd6440af75 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.