PT-2024-9375 · Ivanti · Ivanti Cloud Services Appliance
Published
2024-12-10
·
Updated
2025-01-17
·
CVE-2024-11773
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Ivanti Cloud Services Appliance versions prior to 5.0.3
Description:
The issue is related to a lack of protection against SQL query structure exploitation in the admin web console of Ivanti Cloud Services Appliance. This allows a remote authenticated attacker with admin privileges to execute arbitrary SQL statements.
Recommendations:
For versions prior to 5.0.3, update to version 5.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin web console to minimize the risk of exploitation.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ivanti Cloud Services Appliance