Vulnerabilities > CVE-2018-15593 - Unspecified vulnerability in Ivanti Workspace Control

CVSS 2.1 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

NONE

Availability impact

NONE

local

low complexity

ivanti

NVD

Published: 2018-10-15

Updated: 2019-10-03

Summary

An issue was discovered in Ivanti Workspace Control before 10.3.10.0 and RES One Workspace. A local authenticated user can decrypt the encrypted datastore or relay server password by leveraging an unspecified attack vector.

Vulnerable Configurations

Part	Description	Count
Application	Ivanti Ivanti Workspace Control 10.1.0.0 Ivanti Workspace Control 10.2.0.0 Ivanti Workspace Control 10.2.0.1 Ivanti Workspace Control 10.2.500.1 Ivanti Workspace Control 10.2.600.1 Ivanti Workspace Control 10.2.700.1 Ivanti Workspace Control 10.2.800.0 Ivanti Workspace Control 10.2.900.1 Ivanti Workspace Control 10.2.950.0 Ivanti Workspace Control 10.3.0.0	10

References

http://packetstormsecurity.com/files/149616/Ivanti-Workspace-Control-Registry-Stored-Credentials.html
http://seclists.org/fulldisclosure/2018/Oct/3
https://community.ivanti.com/docs/DOC-69693
https://seclists.org/bugtraq/2018/Oct/5
https://www.securify.nl/en/advisory/SFY20180804/stored-credentials-ivanti-workspace-control-can-be-retrieved-from-registry.html