Login Request a demo
Critical severity · published Mar 19, 2020
CVE-2019-16382
An issue was discovered in Ivanti Workspace Control 10.3.110.0
9.8
CVSS
2.9%
EPSS
No
On KEV
Description
An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work folder used by PowerGrid. A malicious PowerGrid XML file can then be created, after which the folder is renamed back to its original value. Also, CVE-2018-15591 exploitation can consequently be achieved by using PowerGrid with the /SEE parameter to execute the arbitrary command specified in the XML file.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
Workspace Control · Ivanti
10.3.110.0 · source: NVD
Affected product
WC
Workspace Control
Ivanti
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16382
Patch
https://forums.ivanti.com/s/article/Security-Alert-Ivanti-Workspace-Control-September-2019
Third Party Advisory
https://twitter.com/jmoosdijk
More from Workspace Control
7.8
CVE-2025-5353
A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials
7.8
CVE-2025-22455
A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials
7.8
CVE-2024-8496
Under specific circumstances, insecure permissions in Ivanti Workspace Control before version 10.18.40.0 allows a local authenticated attacker to achieve local privilege…
7.8
CVE-2024-44107
DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges and…
7.8
CVE-2024-44106
Insufficient server-side controls in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their…