Improper Access Control in Ivanti N-ITSM Allows Persistent Access

Executive Summary

This vulnerability exists in Ivanti N-ITSM versions before 2025.4. It involves improper protection of an alternate access path, which allows a remote authenticated attacker to maintain access to the system even after their user account has been disabled.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow an attacker who has already authenticated to continue accessing the system despite their account being disabled. This means that disabling a compromised account may not be sufficient to prevent unauthorized access, potentially leading to unauthorized data exposure or misuse.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote authenticated attacker to retain access even after their account has been disabled, which could lead to unauthorized access to sensitive data.

Such unauthorized access may violate compliance requirements in standards and regulations like GDPR and HIPAA, which mandate strict access controls and timely revocation of access rights to protect personal and health information.

Useful 0 Not Useful 0