7.2
Élevée
Exploitée
CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-77
Description
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| CSA (Cloud Services Appliance) 5.0 | premières → < 5.0.2 | 5.0.2 |
| endpoint_manager_cloud_services_appliance 5.0 | premières → < 5.0.2 | 5.0.2 |
Références
- forums.ivanti.com forums.ivanti.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de CSA (Cloud Services Appliance)
Les 6 CVE de CSA (Cloud Services Appliance) →
CVE-2025-22460
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to…
7.8
Élevée
CVE-2024-9381
Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass…
7.2
Élevée
CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
6.5
Moyenne
CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
9.4
Critique