Authentication Bypass in Ivanti Sentry

Compliance Impact

This Authentication Bypass vulnerability allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. Such unauthorized access can lead to exposure, modification, or deletion of sensitive data, which may result in non-compliance with data protection regulations such as GDPR and HIPAA.

Specifically, the ability to bypass authentication and gain administrative privileges undermines the security controls required to protect personal and health information, potentially violating requirements for access control, data integrity, and confidentiality mandated by these standards.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Authentication Bypass (CWE-288) found in Ivanti Sentry versions before R10.5.2, R10.6.2, and R10.7.1. It allows a remote unauthenticated attacker to create arbitrary administrative accounts and gain full administrative access to the system.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe because it allows an attacker without any authentication to create administrative accounts. This means the attacker can gain full administrative control over the affected Ivanti Sentry system, potentially leading to unauthorized access, data manipulation, disruption of services, and complete compromise of the system.

Useful 0 Not Useful 0