CVE-2025-0292

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to access internal network services.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
Ivanti	Connect Secure	—
Ivanti	Policy Secure	—

References

https://forums.ivanti.com/s/article/July-Security-Advisory-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Multiple-CVEsVendor Advisory

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-02932.7CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticat CVE-2025-02948.8A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vuln CVE-2025-02955.4A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functi CVE-2025-02969.8A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the fil CVE-2025-02976.3A vulnerability was found in code-projects Online Book Shop 1.0. It has been declared as critical. This vulnerability affects unknown code o CVE-2025-02989.8A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing o CVE-2025-02999.8A vulnerability classified as critical has been found in code-projects Online Book Shop 1.0. Affected is an unknown function of the file /se CVE-2025-03008.8A vulnerability classified as critical was found in code-projects Online Book Shop 1.0. Affected by this vulnerability is an unknown functio CVE-2025-03016.1A vulnerability, which was classified as problematic, has been found in code-projects Online Book Shop 1.0. Affected by this issue is some u CVE-2025-03025.5in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow.CVE-2025-03037.8in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information le CVE-2025-03047.8in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information le