PT-2024-9037 · Ivanti · Ivanti Policy Secure+1
Published
2024-06-19
·
Updated
2024-12-01
·
CVE-2024-38656
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Ivanti Connect Secure versions prior to 22.7R2.2 and 9.1R18.9
Ivanti Policy Secure versions prior to 22.7R1.2
Description:
The issue is related to argument injection, which allows a remote authenticated attacker with admin privileges to achieve remote code execution. This can be exploited by modifying or injecting arguments, enabling the attacker to execute arbitrary code remotely.
Recommendations:
For Ivanti Connect Secure versions prior to 22.7R2.2 and 9.1R18.9, update to version 22.7R2.2 or 9.1R18.9 or later.
For Ivanti Policy Secure versions prior to 22.7R1.2, update to version 22.7R1.2 or later.
As a temporary workaround, consider restricting access to admin privileges to minimize the risk of exploitation.
Fix
Unrestricted File Upload
Argument Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Ivanti Connect Secure
Ivanti Policy Secure