A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:12
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US - Vendor Advisory |
31 Oct 2023, 15:09
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-367 | |
| CPE | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:* |
|
| References | (MISC) https://forums.ivanti.com/s/article/CVE-2023-38041-New-client-side-release-to-address-a-privilege-escalation-on-Windows-user-machines?language=en_US - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
| First Time |
Microsoft
Ivanti Ivanti secure Access Client Microsoft windows |
25 Oct 2023, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-25 18:17
Updated : 2025-03-07 19:15
NVD link : CVE-2023-38041
Mitre link : CVE-2023-38041
CVE.ORG link : CVE-2023-38041
JSON object : View
Products Affected
ivanti
- secure_access_client
microsoft
- windows
CWE
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition