CVE-2024-8190
גבוהה 7.2 מנוצלת בשטח (KEV)
ניצול פעיל מאומת — קטלוג CISA KEV
- שם
- Ivanti Cloud Services Appliance OS Command Injection Vulnerability
- נוסף לקטלוג
- יעד טיפול (פדרלי)
- פעולה נדרשת
- As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
תיאור (מקור, אנגלית)
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
מדדים
- CVSS 3.1
-
7.2 (HIGH)
מקור הציון: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS — סבירות ניצול
- 89% (אחוזון 100) נכון ל-26/7/2026
- CWE
- CWE-78
מוצרים מושפעים
ivanti: cloud services appliance
קישורים
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-App… Vendor Advisory
- https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-up… US Government Resource
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-202… US Government Resource