Vulnerability Details : CVE-2022-35258
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
Vulnerability category: Denial of service
Products affected by CVE-2022-35258
- cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r2.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r3.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r4.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r5.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r6.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r7.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r8.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r9.0:*:*:*:*:*:*
- cpe:2.3:a:ivanti:connect_secure:9.1:r12.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*
- cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*
- cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-35258
1.25%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 77 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-35258
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2022-35258
-
Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.Assigned by: support@hackerone.com (Secondary)
-
The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-35258
-
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW
Pulse Security Advisory: SA45520 - CVE's (CVE-2022-35254,CVE-2022-35258) may lead to DoS attackThird Party Advisory
Jump to