Vulnerability details

CVE-2024-11007

Ivanti Connect SecureIvanti Policy Secure

CVSS 3.1

9.1Critical

Official description

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (ivanti)	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Ivanti	Connect Secure	22.7r2.1	CISA ADP / Vulnrichment
Ivanti	Policy Secure	22.7r1.1	CISA ADP / Vulnrichment

References and advisories

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-11-12
Last updated: 2024-11-22
State: Published
Assigner (CNA): ivanti

Exploit prediction (EPSS)

1.64%

Probability of exploitation in 30 days

76.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')