PT-2024-9037 · Ivanti · Ivanti Policy Secure+1

Published

2024-06-19

·

Updated

2024-12-01

·

CVE-2024-38656

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.2 and 9.1R18.9 Ivanti Policy Secure versions prior to 22.7R1.2
Description: The issue is related to argument injection, which allows a remote authenticated attacker with admin privileges to achieve remote code execution. This can be exploited by modifying or injecting arguments, enabling the attacker to execute arbitrary code remotely.
Recommendations: For Ivanti Connect Secure versions prior to 22.7R2.2 and 9.1R18.9, update to version 22.7R2.2 or 9.1R18.9 or later. For Ivanti Policy Secure versions prior to 22.7R1.2, update to version 22.7R1.2 or later. As a temporary workaround, consider restricting access to admin privileges to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Argument Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-10719
CVE-2024-38656

Affected Products

Ivanti Connect Secure
Ivanti Policy Secure