CVE-2024-8190

Published Sep 10, 2024

Last updated 9 months ago

Exploit known CVSS high 7.2

VPN

Overview

Description: An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed
Products: cloud_services_appliance

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Ivanti Cloud Services Appliance OS Command Injection Vulnerability
Exploit added on: Sep 13, 2024
Exploit action due: Oct 4, 2024
Required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-78
nvd@nist.gov: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:cloud_services_appliance:4.6:-:*:*:*:*:*:*",
            "matchCriteriaId": "3B63CA83-3DB3-4670-878E-17A54586B25E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:cloud_services_appliance:4.6:patch_518:*:*:*:*:*:*",
            "matchCriteriaId": "61C0BF44-691D-4811-BE9E-FB9B6CC856B9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References