CVE-2024-9380
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
CVSS
—
Sin CVSS
EPSS
59.7%
p99
KEV
SÍ
9 oct 2024
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Producto
Ivanti / Cloud Services Appliance (CSA)
Vulnerabilidad
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Añadido a KEV
9 oct 2024
Remediar antes de
30 oct 2024
Uso conocido en ransomware
No
Descripción resumida
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Acción requerida
As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Notas
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9380