VDB
CVE-2024-9380
CVE-2024-9380
PUBLISHED
KEV
Es besteht eine Schwachstelle in der Ivanti Cloud Services Appliance. Dieser Fehler existiert wegen einer OS-Befehlsinjektion in der Admin-Webkonsole. Ein entfernter authentifizierter Angreifer mit Admin-Rechten kann diese Schwachstelle ausnutzen, um beliebigen Code auszuführen.
EPSS 86.91% · 99.4th percentile
Risk Scores
EPSS Score
86.91%
99.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ivanti | Ivanti Cloud Services Appliance <5.0.2 |
Timeline
- Oct 8, 2024 CVE Published
- Oct 9, 2024 CISA KEV Added
- Oct 9, 2024 EPSS Score
- Oct 10, 2024 EPSS Score
- Oct 14, 2024 Coalition ESS Score
- Oct 29, 2024 PoC Published
- Dec 24, 2024 Coalition ESS Score
- Jan 22, 2025 Coalition ESS Score
- Feb 9, 2025 Coalition ESS Score
- Feb 12, 2025 Coalition ESS Score
- Feb 16, 2025 Coalition ESS Score
- Feb 20, 2025 Coalition ESS Score
References
- https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3120.json advisory
- https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3120 advisory
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 advisory