PT-2024-8703 · Ivanti · Ivanti Policy Secure+1

Published

2024-11-11

·

Updated

2025-01-17

·

CVE-2024-11005

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1
Description The issue is related to command injection, allowing a remote authenticated attacker with admin privileges to achieve remote code execution. This is due to the failure to neutralize special elements used in the operating system command. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.
Technical details about exploitation include the use of command injection to execute arbitrary code. No specific API endpoints, vulnerable parameters, or function names are mentioned.
Recommendations For Ivanti Connect Secure versions prior to 22.7R2.1, update to version 22.7R2.1 or later. For Ivanti Policy Secure versions prior to 22.7R1.1, update to version 22.7R1.1 or later. As a temporary workaround, consider restricting access to admin privileges until a patch is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-10305
CVE-2024-11005

Affected Products

Ivanti Connect Secure
Ivanti Policy Secure