Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.
History

Fri, 22 Nov 2024 16:45:00 +0000

Type Values Removed Values Added
Description Command injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Tue, 12 Nov 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Ivanti
Ivanti connect Secure
Ivanti policy Secure
CPEs cpe:2.3:a:ivanti:connect_secure:22.7r2.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7r1.1:*:*:*:*:*:*:*
Vendors & Products Ivanti
Ivanti connect Secure
Ivanti policy Secure
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Tue, 12 Nov 2024 16:30:00 +0000

Type Values Removed Values Added
Description Command injection in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}


cve-icon MITRE

Status: PUBLISHED

Assigner: ivanti

Published: 2024-11-12T16:06:16.240Z

Updated: 2024-11-22T16:32:34.967Z

Reserved: 2024-11-07T21:56:06.635Z

Link: CVE-2024-11006

cve-icon Vulnrichment

Updated: 2024-11-12T19:56:08.452Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-11-12T17:15:07.333

Modified: 2024-11-22T17:15:06.913

Link: CVE-2024-11006

cve-icon Redhat

No data.