CVE-2024-8963

Published Sep 19, 2024

Last updated 2 months ago

Exploit known CVSS critical 9.1

Overview

Description: Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability
Exploit added on: Sep 19, 2024
Exploit action due: Oct 10, 2024
Required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Weaknesses

nvd@nist.gov: CWE-22
3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-22

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4F3651A6-CE83-4DB9-984E-5BFD6AF7F42D"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_512:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9B0B3862-470F-4FEE-988F-E8E004A2F5AB"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_518:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "591B2354-0874-408A-BFB8-59452C33A5B1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

References