CVE-2019-16382: ivanti workspace_control
Vulnerability summary
CVE-2019-16382 is a critical (CVSS 9.8) vulnerability in ivanti workspace_control. EPSS estimates a 2.88% chance of exploitation in the next 30 days, higher than 86.6% of scored vulnerabilities.
Timeline
- 19-03-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.88%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.88% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ivanti1 product
- workspace_control10.3.110.0
1 vendor · 1 product
References
2 links- forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019X Refsource CONFIRMPatchVendor Advisory