Vulnerability Details : CVE-2023-38551
A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2023-38551
Please log in to view affected product information.
Exploit prediction scoring system (EPSS) score for CVE-2023-38551
1.01%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-38551
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.2
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H |
2.3
|
5.3
|
HackerOne | 2024-05-31 |
CWE ids for CVE-2023-38551
-
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2023-38551
-
https://forums.ivanti.com/s/article/Security-Advisory-May-2024
Security Advisory May 2024
Jump to