Vulnerabilities > CVE-2021-36235 - Unspecified vulnerability in Ivanti Workspace Control

CVSS 4.6 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

local

low complexity

ivanti

NVD

Published: 2021-09-01

Updated: 2021-09-08

Summary

An issue was discovered in Ivanti Workspace Control before 10.6.30.0. A locally authenticated user with low privileges can bypass File and Folder Security by leveraging an unspecified attack vector. As a result, the attacker can start applications with elevated privileges.

Vulnerable Configurations

Part	Description	Count
Application	Ivanti Ivanti Workspace Control 10.1.0.0 Ivanti Workspace Control 10.2.0.0 Ivanti Workspace Control 10.2.0.1 Ivanti Workspace Control 10.2.500.1 Ivanti Workspace Control 10.2.600.1 Ivanti Workspace Control 10.2.700.1 Ivanti Workspace Control 10.2.800.0 Ivanti Workspace Control 10.2.900.1 Ivanti Workspace Control 10.2.950.0 Ivanti Workspace Control 10.3.0.0 Ivanti Workspace Control 10.3.10.0 Ivanti Workspace Control 10.3.20.0 Ivanti Workspace Control 10.3.30.0 Ivanti Workspace Control 10.3.40.0 Ivanti Workspace Control 10.3.50.0 Ivanti Workspace Control 10.3.90.0 Ivanti Workspace Control 10.3.110.0 Ivanti Workspace Control 10.3.180.0 Ivanti Workspace Control 10.4.30.0 Ivanti Workspace Control 10.4.40.0	20

References

https://forums.ivanti.com/s/article/A-locally-authenticated-user-with-low-privileges-can-bypass-the-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vector