Vulnerability details

CVE-2024-39709

Ivanti Connect SecureIvanti Policy Secure

CVSS 3.0

7.8High

Official description

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

CVSS scores

Score	Version	Source	Vector
7.8High	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
7.8High	3.0	CVEProject cvelistV5 (CNA) (hackerone)	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Ivanti	Connect Secure	v < 22.6R2	CISA ADP / Vulnrichment
Ivanti	Connect Secure	22.6R2 ≤ v < 22.6R2	CVEProject cvelistV5 (CNA)
Ivanti	Policy Secure	v < 22.6R1	CISA ADP / Vulnrichment
Ivanti	Policy Secure	22.7R1 ≤ v < 22.7R1	CVEProject cvelistV5 (CNA)

References and advisories

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-11-13
Last updated: 2024-11-24
State: Published
Assigner (CNA): hackerone

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-732
Incorrect Permission Assignment for Critical Resource