Security readout for executives and security teams
Plain-English summary
This flaw lets a low-privileged local user bypass Ivanti Workspace Control application restrictions when Workspace Preferences is enabled. The practical risk is erosion of application control: users may start programs that policy intended to block.
Executive priority
Treat this as a moderate endpoint control bypass. It is not described as remote code execution, but it can weaken software restriction policy in managed workspaces.
Technical view
CVE-2019-19675 affects Ivanti Workspace Control versions before 10.3.180.0. The CVE describes a locally authenticated low-privilege bypass of Managed Application Security through an unspecified Workspace Preferences vector. The Ivanti reference title mentions File and Folder Security, so the exact control naming is not fully consistent in the provided sources.
Likely exposure
Exposure is most likely on endpoints or virtual workspace environments running Ivanti Workspace Control before 10.3.180.0, with Workspace Preferences enabled, where application allow/block policy is security-relevant.
Exploitation context
The provided sources do not show active exploitation or public exploit availability. The attacker must already be locally authenticated with low privileges. The attack vector is unspecified, limiting validation detail.
Researcher notes
Key gaps: no CVSS, no CWE, no detailed vector, and inconsistent control terminology between the CVE description and Ivanti reference title. Avoid assuming broader Ivanti product impact beyond Workspace Control before 10.3.180.0.
Mitigation direction
- Inventory Ivanti Workspace Control deployments and identify versions before 10.3.180.0.
- Upgrade affected deployments to 10.3.180.0 or a later vendor-supported release.
- Check Ivanti guidance for any configuration-specific workarounds or compensating controls.
- Review whether Workspace Preferences is enabled where application restrictions are required.
- Monitor endpoints for unexpected launches of applications blocked by policy.
Validation and detection
- Confirm installed Ivanti Workspace Control versions across managed environments.
- Verify whether Workspace Preferences is enabled on affected systems.
- Review application control policy logs for blocked applications that were later launched.
- Test remediation by confirming blocked applications remain blocked after update or configuration change.
- Document any systems where upgrade cannot be completed promptly.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19675 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://forums.ivanti.com/s/article/Locally-authenticated-user-can-bypass-File-and-Folder-Security-by-leveraging-an-unspecified-attack-vectorCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.