Ivanti released updates for multiple critical flaws in Cloud Services Application (CSA), Connect Secure, Policy Secure, and Sentry
Take action: Another big and urgent advisory from Ivanti. Prioritize patching of Cloud Services Application (CSA) immediately. It has a perfect 10 flaw so don't delay. After addressing CSA, proceed to Connect Secure and Policy Secure, although you don't need to panic (that much).
Learn More
Ivanti has released critical security updates addressing multiple critical vulnerabilities across several products, including Cloud Services Application (CSA), Connect Secure, Policy Secure, and Sentry.
- CVE-2024-11639 (CVSS score 10.0) - Authentication bypass vulnerability. Allows unauthenticated remote attackers to gain administrative access. Affects Ivanti CSA before 5.0.3.
- CVE-2024-11772 (CVSS score 9.1) - Command injection vulnerability. Allows authenticated admin users to execute arbitrary code remotely. Affects Ivanti CSA before 5.0.3, but requires administrative privileges to exploit.
- CVE-2024-11773 (CVSS score 9.1) - SQL injection vulnerability. Enables execution of arbitrary SQL statements. Affects Ivanti CSA before 5.0.3, but requires administrative privileges to exploit.
- CVE-2024-11633 (CVSS score 9.1) - Argument injection in Connect Secure
- CVE-2024-11634 (CVSS score 9.1) - Command injection in Connect Secure and Policy Secure
- CVE-2024-8540 (CVSS score 8.8) - Insecure permissions in Ivanti Sentry
- Ivanti Cloud Services Application: Version 5.0.3
- Ivanti Connect Secure: Version 22.7R2.4
- Ivanti Policy Secure: Version 22.7R1.2
- Ivanti Sentry: Versions 9.20.2, 10.0.2, and 10.1.0
While Ivanti reports no active exploitation of these vulnerabilities, immediate patching is strongly recommended given the history of state-sponsored threat actors targeting Ivanti product vulnerabilities.
