Orta CVSS 6.8
CVE-2025-55139: Connect Secure: sunucu taraflı istek sahteciliği (SSRF)
Açıklama (NVD)
SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to enumerate internal services.
Özet bilgiler
- Ürün
- Ivanti Connect Secure
- CVSS v3.1
- 6.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - EPSS
- %0,91 (yüzdelik 60)
- CWE
- CWE-918
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| ivanti-connect-secure | — | — | 22.7 |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-connect-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | — | — | 22.7 |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-policy-secure | 22.7 | 22.7 | — |
| ivanti-zero-trust-access-gateway | 22.8 | 22.8 | — |
| ivanti-neurons-for-secure-access | — | — | 22.8 |
| ivanti-neurons-for-secure-access | 22.8 | 22.8 | — |
| ivanti-neurons-for-secure-access | 22.8 | 22.8 | — |
| ivanti-neurons-for-secure-access | 22.8 | 22.8 | — |