CVE-2024-8963
Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
CISA notes
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963 ; https://nvd.nist.gov/vuln/detail/CVE-2024-8963
Description
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:LAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | CSA (Cloud Services Appliance) | 4.6 Patch 519 (unaffected) 5.0 (unaffected) |
References
1 LinksRecord Details
More from Ivanti
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Related Tool Categories
Tool categories that test for or protect against this vulnerability class.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.