← Vulnerability feed

Vulnerability record · CVE-2023-34298 · published 3 May 2024

CVE-2023-34298: Ivanti pulse secure desktop client path traversal vulnerability

Ivanti · Pulse Secure Desktop Client

Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Pulse Secure Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within SetupService. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service. Was ZDI-CAN-17687.

7.8 CVSS 3.0 High EPSS 0.97% · top 39.6% CWE-22 · Path traversal
7.8CVSS 3.0 base score
0.97%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Pulse Secure Client SetupService Directory Traversal Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Pulse Secure Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within SetupService. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service. Was ZDI-CAN-17687.

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.zerodayinitiative.com/advisories/ZDI-23-858/ Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-858/ Third Party Advisory
https://forums.ivanti.com/s/article/CVE-2023-34298-Ivanti-Secure-Access-Client-local-privilege-escalation?language=en_US Vendor Advisory

Track CVE-2023-34298 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-8992Ivanti secure access client improper certificate validation vulnerabilityAn improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenticated attacker to execute arb…EPSS 1.2%7.8CVE-2025-22454Ivanti secure access client incorrect permission assignment vulnerabilityInsufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privilege…EPSS 0.30%7.8CVE-2024-37398Ivanti secure access client vulnerabilityInsufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.EPSS 0.32%7.8CVE-2024-7571Ivanti secure access client vulnerabilityIncorrect permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.EPSS 0.26%7.8CVE-2023-38042Ivanti secure access client execution with unnecessary privileges vulnerabilityA local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM.EPSS 0.34%7.8CVE-2023-38543Ivanti secure access client allocation without limits vulnerabilityA vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to explo…EPSS 0.37%7.8CVE-2023-41718Ivanti secure access client incorrect default permissions vulnerabilityWhen a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having cont…EPSS 0.45%7.8CVE-2023-35080Ivanti secure access client incorrect default permissions vulnerabilityA vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulne…EPSS 0.71%

Source: NIST National Vulnerability Database (record CVE-2023-34298), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.