7.2
Élevée
Exploitée
CVE-2024-8190 Ivanti Cloud Services Appliance OS Command Injection Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-78
Description
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| CSA (Cloud Services Appliance) 5.0 | premières → < 5.0 | 5.0 |
| endpoint_manager_cloud_services_appliance 5.0 | premières → < 5.0 | 5.0 |
Références
- forums.ivanti.com forums.ivanti.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de CSA (Cloud Services Appliance)
Les 6 CVE de CSA (Cloud Services Appliance) →
CVE-2025-22460
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to…
7.8
Élevée
CVE-2024-9381
Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass…
7.2
Élevée
CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
7.2
Élevée
CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
6.5
Moyenne