Ivanti Connect Secure and Ivanti Policy Secure Sensitive Information Log Injection Vulnerability

A vulnerability exists in Ivanti Connect Secure (ICS) versions prior to 22.7R2.8 and Ivanti Policy Secure (IPS) versions prior to 22.7R1.5, allowing local authenticated attackers to access sensitive information inadvertently logged by the application. This issue arises from the improper handling of confidential data, which is written to log files where it can be retrieved by unauthorized users.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information, which could be misused or disclosed inappropriately.

Remediation

Users can upgrade to Ivanti Connect Secure version 22.7R2.8 or Ivanti Policy Secure version 22.7R1.5 to address this vulnerability. These versions are available through the Ivanti Download Portal.