CVE-2023-38551

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H

Weakness enumeration

CWE-93

Affected software

No affected versions have been published.

Timeline

Published: May 31, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-385527.5When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a CVE-2023-385536.7In gnss service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wit CVE-2023-385545.5In wcn bsp driver, there is a possible out of bounds write due to a missing bounds check.This could lead to local denial of service with no CVE-2023-385558.8Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacke CVE-2023-385567.5Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. [Note] Web Co CVE-2023-385577.8A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected product assigns improper access rights to the u CVE-2023-385585.5A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console CVE-2023-385595.5A buffer overflow flaw was found in base/gdevdevn.c:1973 in devn_pcx_write_rle() in ghostscript. This issue may allow a local attacker to ca CVE-2023-38566.1A vulnerability, which was classified as problematic, has been found in phpscriptpoint Ecommerce 1.15. Affected by this issue is some unknow CVE-2023-385605.5An integer overflow flaw was found in pcl/pl/plfont.c:418 in pl_glyph_name in ghostscript. This issue may allow a local attacker to cause a CVE-2023-385617.8Improper access control in some Intel(R) XTU software before version 7.12.0.29 may allow an authenticated user to potentially enable escalat CVE-2023-385629.1A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafte