VDB
CVE-2024-11633
CVE-2024-11633
PUBLISHED
In Ivanti Connect Secure und Ivanti Policy Secure existieren mehrere Schwachstellen. Diese bestehen aufgrund einer Argument Injection und einer Command Injection. Ein entfernter, authentisierter Angreifer mit Admin Privilegien kann diese Schwachstelle ausnutzen, um beliebigen Code zur Ausführung zu bringen.
EPSS 12.69% · 94.1th percentile
Risk Scores
EPSS Score
12.69%
94.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Ivanti Connect Secure <22.7R2.4 | |
| Ivanti | Ivanti Policy Secure <22.7R1.2 |
Timeline
- Dec 10, 2024 CVE Published
- Dec 10, 2024 PoC Published
- Dec 11, 2024 EPSS Score
- Dec 11, 2024 PoC Published
- Dec 24, 2024 PoC Published
- Jan 17, 2025 CVE Updated
- Feb 7, 2025 Coalition ESS Score
- Mar 27, 2025 EPSS Score
- Mar 28, 2025 EPSS Score
- Apr 7, 2025 EPSS Score
- Apr 13, 2025 EPSS Score
- May 4, 2025 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3680.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3680 advisory
- https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs?language=en_US advisory