Ivanti has launched safety updates to handle a number of important flaws in its Cloud Companies Software (CSA) and Join Safe merchandise that would result in privilege escalation and code execution.
The listing of vulnerabilities is as follows –
- CVE-2024-11639 (CVSS rating: 10.0) – An authentication bypass vulnerability within the admin internet console of Ivanti CSA earlier than 5.0.3 that enables a distant unauthenticated attacker to realize administrative entry
- CVE-2024-11772 (CVSS rating: 9.1) – A command injection vulnerability within the admin internet console of Ivanti CSA earlier than model 5.0.3 that enables a distant authenticated attacker with admin privileges to attain distant code execution
- CVE-2024-11773 (CVSS rating: 9.1) – An SQL injection vulnerability within the admin internet console of Ivanti CSA earlier than model 5.0.3 that enables a distant authenticated attacker with admin privileges to run arbitrary SQL statements
- CVE-2024-11633 (CVSS rating: 9.1) – An argument injection vulnerability in Ivanti Join Safe earlier than model 22.7R2.4 that enables a distant authenticated attacker with admin privileges to attain distant code execution
- CVE-2024-11634 (CVSS rating: 9.1) – A command injection vulnerability in Ivanti Join Safe earlier than model 22.7R2.3 and Ivanti Coverage Safe earlier than model 22.7R1.2 that enables a distant authenticated attacker with admin privileges to attain distant code execution
- CVE-2024-8540 (CVSS rating: 8.8) – An insecure permissions vulnerability in Ivanti Sentry earlier than variations 9.20.2 and 10.0.2 or 10.1.0 that enables an area authenticated attacker to switch delicate software parts
The shortcomings have been addressed within the beneath variations –
- Ivanti Cloud Companies Software 5.0.3
- Ivanti Join Safe 22.7R2.4
- Ivanti Coverage Safe 22.7R1.2
- Ivanti Sentry 9.20.2, 10.0.2, and 10.1.0
Whereas Ivanti has emphasised that it isn’t conscious of lively exploitation of any of the aforementioned flaws, it is crucial that customers take fast motion on condition that a number of flaws in its merchandise have been abused by state-sponsored attackers for malicious actions.