CVE-2023-38543

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to a denial of service (DoS) condition on the user machine.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
Ivanti	Secure Access Client Windows	>= 22.6R1.1, < 22.6R1.1

References

Timeline

Published: Nov 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-385445.5A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability c CVE-2023-385459.8This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCK CVE-2023-385463.7This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. CVE-2023-385479.8A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its CVE-2023-385484.3A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-385495.4A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-38556.1A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functional CVE-2023-385518.2A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on CVE-2023-385527.5When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a CVE-2023-385536.7In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wit CVE-2023-385545.5In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no CVE-2023-385558.8Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacke