Ivanti Workspace Control Hardcoded Key Vulnerability Allowing Decryption of SQL Credentials

A vulnerability exists in Ivanti Workspace Control versions prior to 10.19.0.0, where a hardcoded key allows local authenticated attackers to decrypt stored SQL credentials. This vulnerability could lead to unauthorized access to sensitive database information.

Impact

Exploitation of this vulnerability could result in the decryption of SQL credentials, potentially allowing unauthorized access to databases and the information they contain.

Remediation

Users can upgrade to Ivanti Workspace Control version 10.19.10.0, which addresses this vulnerability. Instructions for migrating to the new IWC architecture are available on the Ivanti help site. Customers who prefer not to upgrade can migrate to Ivanti User Workspace Manager.