PT-2024-6587 · Ivanti · Ivanti Workspace Control

Published 2024-09-10 · Updated 2024-09-18 · CVE-2024-44107

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below

Description: The issue is related to an uncontrolled search path element in the Ivanti Workspace Control software, which can be exploited to allow an attacker to escalate their privileges and execute arbitrary code. This can be achieved through DLL hijacking in the management console. A local authenticated attacker can exploit this issue.

Recommendations: For Ivanti Workspace Control versions 10.18.0.0 and below, consider disabling the management console until a patch is available to prevent local attackers from escalating their privileges and executing arbitrary code. Restrict access to the management console to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2024-07733

CVE-2024-44107

Affected Products

Ivanti Workspace Control

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-44107 · Security Note
• https://bdu.fstec.ru/vul/2024-07733 · Security Note
• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-44107 · Vendor Advisory
• https://t.me/cvenotify/95129 · Telegram Post
• https://t.me/cvedetector/5310 · Telegram Post
• https://twitter.com/CVEnew/status/1833615168955105354 · Twitter Post
• https://twitter.com/CveFindCom/status/1833611692225237204 · Twitter Post