CVE-2023-38041 — Ivanti / Secure Access Client

Description (CNA)

A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.

Affected (CNA)

Vendor / product	Versions
Ivanti / Secure Access Client	affected 22.6R1 before 22.6R1

CWE

No CWE identifiers supplied.

References

https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US

ADP enrichment

CVE

No English description supplied.

https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US

CISA-ADP

No English description supplied.

No references supplied.