RadioCSIRT - WID-SEC-W-2024-3433 - Vulnerability-Lookup

WID-SEC-W-2024-3433

Vulnerability from csaf_certbund - Published: 2024-11-12 23:00 - Updated: 2024-11-12 23:00

Summary

Ivanti Connect Secure: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Connect Secure bietet TLS- und mobile VPN-Lösungen. Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung. Der Ivanti Secure Access Client ist ein VPN Client für Ivanti Connect Secure.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, einen Denial-of-Service Zustand zu erzeugen und Daten zu modifizieren

Betroffene Betriebssysteme: - Sonstiges - Windows

CVE-2024-11004

Affected products

Known affected 3 products

Product	Identifier	Version	Remediation
Ivanti Secure Access Client <22.7R4 Ivanti / Secure Access Client		<22.7R4
Ivanti Policy Secure <22.7R1.2 Ivanti / Policy Secure		<22.7R1.2
Ivanti Connect Secure <22.7R2.3 Ivanti / Connect Secure		<22.7R2.3

CVE-2024-11005

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-11006

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-11007

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-37400

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-38649

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-38655

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-38656

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-38657

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-39710

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-39711

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-39712

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-47905

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-47907

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-47908

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-47909

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-8495

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-9420

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-29211

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-37398

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-38654

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-39709

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-47906

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-7571

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-8539

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-9842

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

CVE-2024-9843

Affected products

Known affected 3 products, the same list as for CVE-2024-11004

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://forums.ivanti.com/s/article/Security-Advi…	external

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Connect Secure bietet TLS- und mobile VPN-L\u00f6sungen.\r\nIvanti Policy Secure ist eine Network Access Control (NAC) L\u00f6sung.\r\nDer Ivanti Secure Access Client ist ein VPN Client f\u00fcr Ivanti Connect Secure.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure, Ivanti Policy Secure und Ivanti Secure Access Client ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, einen Denial-of-Service Zustand zu erzeugen und Daten zu modifizieren",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3433 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3433.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3433 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3433"
      },
      {
        "category": "external",
        "summary": "Ivanti Security Advisory Ivanti Connect Secure vom 2024-11-12",
        "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US"
      }
    ],
    "source_lang": "en-US",
    "title": "Ivanti Connect Secure: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-11-12T23:00:00.000+00:00",
      "generator": {
        "date": "2026-07-16T17:12:29.643+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2024-3433",
      "initial_release_date": "2024-11-12T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-12T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c22.7R2.3",
                "product": {
                  "name": "Ivanti Connect Secure \u003c22.7R2.3",
                  "product_id": "T039019"
                }
              },
              {
                "category": "product_version",
                "name": "22.7R2.3",
                "product": {
                  "name": "Ivanti Connect Secure 22.7R2.3",
                  "product_id": "T039019-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:connect_secure:22.7r2.3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Connect Secure"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c22.7R1.2",
                "product": {
                  "name": "Ivanti Policy Secure \u003c22.7R1.2",
                  "product_id": "T039020"
                }
              },
              {
                "category": "product_version",
                "name": "22.7R1.2",
                "product": {
                  "name": "Ivanti Policy Secure 22.7R1.2",
                  "product_id": "T039020-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:policy_secure:22.7r1.2"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Policy Secure"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c22.7R4",
                "product": {
                  "name": "Ivanti Secure Access Client \u003c22.7R4",
                  "product_id": "T039021"
                }
              },
              {
                "category": "product_version",
                "name": "22.7R4",
                "product": {
                  "name": "Ivanti Secure Access Client 22.7R4",
                  "product_id": "T039021-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ivanti:secure_access_client:22.7r4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Secure Access Client"
          }
        ],
        "category": "vendor",
        "name": "Ivanti"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-11004",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-11004"
    },
    {
      "cve": "CVE-2024-11005",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-11005"
    },
    {
      "cve": "CVE-2024-11006",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-11006"
    },
    {
      "cve": "CVE-2024-11007",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-11007"
    },
    {
      "cve": "CVE-2024-37400",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-37400"
    },
    {
      "cve": "CVE-2024-38649",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-38649"
    },
    {
      "cve": "CVE-2024-38655",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-38655"
    },
    {
      "cve": "CVE-2024-38656",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-38656"
    },
    {
      "cve": "CVE-2024-38657",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-38657"
    },
    {
      "cve": "CVE-2024-39710",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-39710"
    },
    {
      "cve": "CVE-2024-39711",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-39711"
    },
    {
      "cve": "CVE-2024-39712",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-39712"
    },
    {
      "cve": "CVE-2024-47905",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-47905"
    },
    {
      "cve": "CVE-2024-47907",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-47907"
    },
    {
      "cve": "CVE-2024-47908",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-47908"
    },
    {
      "cve": "CVE-2024-47909",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-47909"
    },
    {
      "cve": "CVE-2024-8495",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-8495"
    },
    {
      "cve": "CVE-2024-9420",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-9420"
    },
    {
      "cve": "CVE-2024-29211",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-29211"
    },
    {
      "cve": "CVE-2024-37398",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-37398"
    },
    {
      "cve": "CVE-2024-38654",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-38654"
    },
    {
      "cve": "CVE-2024-39709",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-39709"
    },
    {
      "cve": "CVE-2024-47906",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-47906"
    },
    {
      "cve": "CVE-2024-7571",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-7571"
    },
    {
      "cve": "CVE-2024-8539",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-8539"
    },
    {
      "cve": "CVE-2024-9842",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-9842"
    },
    {
      "cve": "CVE-2024-9843",
      "product_status": {
        "known_affected": [
          "T039021",
          "T039020",
          "T039019"
        ]
      },
      "release_date": "2024-11-12T23:00:00.000+00:00",
      "title": "CVE-2024-9843"
    }
  ]
}

CVE-2024-11004 (GCVE-0-2024-11004)

Vulnerability from cvelistv5 – Published: 2024-11-12 16:09 – Updated: 2025-04-04 14:34

Summary

Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-04 14:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

ivanti mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

4 products

Vendor	Product	Version
Ivanti	Connect Secure	Unaffected: 22.7R2.1 (custom)
Ivanti	Policy Secure	Unaffected: 22.7R1.1 (custom)
ivanti	connect_secure	Affected: 22.7R2.1 cpe:2.3:a:ivanti:connect_secure:-:::::::*
ivanti	policy_secure	Affected: 22.7R1.1 cpe:2.3:a:ivanti:policy_secure::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R2.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "policy_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R1.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11004",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-04T14:34:14.526993Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-04T14:34:21.002Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eReflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e"
            }
          ],
          "value": "Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-21T16:45:21.591Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2024-11004",
    "datePublished": "2024-11-12T16:09:19.437Z",
    "dateReserved": "2024-11-07T21:56:04.757Z",
    "dateUpdated": "2025-04-04T14:34:21.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11005 (GCVE-0-2024-11005)

Vulnerability from cvelistv5 – Published: 2024-11-12 16:07 – Updated: 2024-11-22 16:33

Summary

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 18:29 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

ivanti mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

4 products

Vendor	Product	Version
Ivanti	Connect Secure	Unaffected: 22.7R2.1 (custom)
Ivanti	Policy Secure	Unaffected: 22.7R1.1 (custom)
ivanti	connect_secure	Affected: 22.7R2.1 cpe:2.3:a:ivanti:connect_secure:-:::::::*
ivanti	policy_secure	Affected: 22.7R1.1 cpe:2.3:a:ivanti:policy_secure::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R2.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "policy_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R1.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11005",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T18:29:40.876421Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T18:30:35.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
            }
          ],
          "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-248",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-248 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T16:33:10.013Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2024-11005",
    "datePublished": "2024-11-12T16:07:45.350Z",
    "dateReserved": "2024-11-07T21:56:05.756Z",
    "dateUpdated": "2024-11-22T16:33:10.013Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11006 (GCVE-0-2024-11006)

Vulnerability from cvelistv5 – Published: 2024-11-12 16:06 – Updated: 2024-11-22 16:32

Summary

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 19:54 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

ivanti mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

4 products

Vendor	Product	Version
Ivanti	Connect Secure	Unaffected: 22.7R2.1 (custom)
Ivanti	Policy Secure	Unaffected: 22.7R1.1 (custom)
ivanti	connect_secure	Affected: 22.7R2.1 cpe:2.3:a:ivanti:connect_secure:22.7r2.1:::::::*
ivanti	policy_secure	Affected: 22.7r1.1 cpe:2.3:a:ivanti:policy_secure:22.7r1.1:::::::*

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:22.7r2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R2.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ivanti:policy_secure:22.7r1.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "policy_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7r1.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11006",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T19:54:21.424345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T20:01:11.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
            }
          ],
          "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-248",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-248 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T16:32:34.967Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2024-11006",
    "datePublished": "2024-11-12T16:06:16.240Z",
    "dateReserved": "2024-11-07T21:56:06.635Z",
    "dateUpdated": "2024-11-22T16:32:34.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11007 (GCVE-0-2024-11007)

Vulnerability from cvelistv5 – Published: 2024-11-12 16:05 – Updated: 2024-11-22 16:32

Summary

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-19 17:12 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

ivanti mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

4 products

Vendor	Product	Version
Ivanti	Connect Secure	Unaffected: 22.7R2.1 (custom)
Ivanti	Policy Secure	Unaffected: 22.7R1.1 (custom)
ivanti	connect_secure	Affected: 22.7r2.1 cpe:2.3:a:ivanti:connect_secure:22.7r2.1:::::::*
ivanti	policy_secure	Affected: 22.7r1.1 cpe:2.3:a:ivanti:policy_secure:22.7r1.1:::::::*

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:22.7r2.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7r2.1"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ivanti:policy_secure:22.7r1.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "policy_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7r1.1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T17:12:02.631664Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T17:13:24.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R1.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
            }
          ],
          "value": "Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-248",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-248 Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-22T16:32:05.425Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2024-11007",
    "datePublished": "2024-11-12T16:05:26.487Z",
    "dateReserved": "2024-11-07T21:56:07.508Z",
    "dateUpdated": "2024-11-22T16:32:05.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-29211 (GCVE-0-2024-29211)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2024-11-13 16:49

Summary

A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files.

Severity

7.1 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 16:49 UTC

CWE

CWE-noinfo Not enough information

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

1 product

Vendor	Product	Version
Ivanti	Secure Access Client	Affected: 22.7R4 , < 22.7R4 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-29211",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T16:49:09.449581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T16:49:48.676Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Access Client",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R4",
              "status": "affected",
              "version": "22.7R4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A race condition in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to modify sensitive configuration files."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-13T01:54:45.547Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-29211",
    "datePublished": "2024-11-13T01:54:45.547Z",
    "dateReserved": "2024-03-19T01:04:06.323Z",
    "dateUpdated": "2024-11-13T16:49:48.676Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-37398 (GCVE-0-2024-37398)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2025-03-13 17:50

Summary

Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 16:45 UTC

CWE

CWE-noinfo Not enough information

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

2 products

Vendor	Product	Version
Ivanti	Secure Access Client	Affected: 22.7R4 , < 22.7R4 (custom)
ivanti	secure_access_client	Affected: 0 , < 22.7_r4 (custom) cpe:2.3:a:ivanti:secure_access_client::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "secure_access_client",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "22.7_r4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37398",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T16:45:06.053110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T17:50:08.929Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Access Client",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R4",
              "status": "affected",
              "version": "22.7R4",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient validation in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-13T01:54:45.406Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-37398",
    "datePublished": "2024-11-13T01:54:45.406Z",
    "dateReserved": "2024-06-08T01:04:07.093Z",
    "dateUpdated": "2025-03-13T17:50:08.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-37400 (GCVE-0-2024-37400)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2024-11-13 16:57

Summary

An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 16:56 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

2 products

Vendor	Product	Version
Ivanti	Connect Secure	Affected: 22.7R2.3 , < 22.7R2.3 (custom)
ivanti	connect_secure	Affected: 22.7R2.3 cpe:2.3:a:ivanti:connect_secure:-:::::::*

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "status": "affected",
                "version": "22.7R2.3"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T16:56:03.123820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T16:57:19.557Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R2.3",
              "status": "affected",
              "version": "22.7R2.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-13T01:54:45.506Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-37400",
    "datePublished": "2024-11-13T01:54:45.506Z",
    "dateReserved": "2024-06-08T01:04:07.093Z",
    "dateUpdated": "2024-11-13T16:57:19.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38649 (GCVE-0-2024-38649)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2024-11-23 21:06

Summary

An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 17:02 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

2 products

Vendor	Product	Version
Ivanti	Connect Secure	Affected: 22.7R2.1 , < 22.7R2.1 (custom)
ivanti	connect_secure	Affected: 0 , < 22.7R2.1 (custom) cpe:2.3:a:ivanti:connect_secure:-:::::::*

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "22.7R2.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38649",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T17:02:35.525619Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T17:03:52.122Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R2.1",
              "status": "affected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-23T21:06:04.739Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38649",
    "datePublished": "2024-11-13T01:54:45.457Z",
    "dateReserved": "2024-06-19T01:04:07.137Z",
    "dateUpdated": "2024-11-23T21:06:04.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38654 (GCVE-0-2024-38654)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2024-11-13 17:01

Summary

Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of service.

Severity

4.4 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 16:59 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

1 product

Vendor	Product	Version
Ivanti	Secure Access Client	Affected: 22.7R3 , < 22.7R3 (custom)

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38654",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T16:59:41.280532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T17:01:06.962Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Secure Access Client",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R3",
              "status": "affected",
              "version": "22.7R3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to cause a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-13T01:54:45.470Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38654",
    "datePublished": "2024-11-13T01:54:45.470Z",
    "dateReserved": "2024-06-19T01:04:07.138Z",
    "dateUpdated": "2024-11-13T17:01:06.962Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38655 (GCVE-0-2024-38655)

Vulnerability from cvelistv5 – Published: 2024-11-13 01:54 – Updated: 2024-11-23 21:06

Summary

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Severity

9.1 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-13 15:36 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

hackerone mitre root Scorecard

References

1 reference

URL	Tags
https://forums.ivanti.com/s/article/Security-Advi…

Impacted products

4 products

Vendor	Product	Version
Ivanti	Connect Secure	Affected: 22.7R2.1 , < 22.7R2.1 (custom) Affected: 9.1R18.9 , < 9.1R18.9 (custom)
Ivanti	Policy Secure	Affected: 22.7R1.1 , < 22.7R1.1 (custom) Affected: 9.1R18.9 , < 9.1R18.9 (custom)
ivanti	connect_secure	Affected: 0 , < 22.7_r2.3 (custom) cpe:2.3:a:ivanti:connect_secure::::::::
ivanti	policy_secure	Affected: 0 , < 22.7_r1.2 (custom) cpe:2.3:a:ivanti:policy_secure::::::::

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "connect_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "22.7_r2.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "policy_secure",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "22.7_r1.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38655",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-13T15:36:18.124138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-88",
                "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-13T15:37:13.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R2.1",
              "status": "affected",
              "version": "22.7R2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1R18.9",
              "status": "affected",
              "version": "9.1R18.9",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R1.1",
              "status": "affected",
              "version": "22.7R1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "9.1R18.9",
              "status": "affected",
              "version": "9.1R18.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-23T21:06:07.435Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-38655",
    "datePublished": "2024-11-13T01:54:45.595Z",
    "dateReserved": "2024-06-19T01:04:07.138Z",
    "dateUpdated": "2024-11-23T21:06:07.435Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.