VDB
CVE-2024-11634
CVE-2024-11634
PUBLISHED
In Ivanti Connect Secure und Ivanti Policy Secure existieren mehrere Schwachstellen. Diese bestehen aufgrund einer Argument Injection und einer Command Injection. Ein entfernter, authentisierter Angreifer mit Admin Privilegien kann diese Schwachstelle ausnutzen, um beliebigen Code zur Ausführung zu bringen.
EPSS 14.23% · 94.5th percentile
Risk Scores
EPSS Score
14.23%
94.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Ivanti Connect Secure <22.7R2.4 | |
| Ivanti | Ivanti Policy Secure <22.7R1.2 |
Timeline
- Dec 10, 2024 CVE Published
- Dec 11, 2024 EPSS Score
- Dec 14, 2024 CVE Updated
- Jan 13, 2025 EPSS Score
- Jan 21, 2025 Coalition ESS Score
- Jan 30, 2025 EPSS Score
- Mar 5, 2025 EPSS Score
- Mar 21, 2025 EPSS Score
- Mar 29, 2025 EPSS Score
- Apr 7, 2025 EPSS Score
- Apr 24, 2025 EPSS Score
- May 1, 2025 EPSS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3680.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3680 advisory
- https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs?language=en_US advisory