Ivanti Connect Secure and Ivanti Policy Secure Multiple Vulnerabilities
Ivanti Connect Secure and Ivanti Policy Secure contain multiple vulnerabilities that allow a remote, authenticated attacker to execute arbitrary code. All of the vulnerabilities except for CVE-2024-39709 require the attacker to be authenticated with administrative privileges to the administrative web interface. CVE-2024-39709 requires the attacker to have 'nr' privileges on the underlying Linux operating system. These vulnerabilities are addressed in Ivanti Connect Secure versions 22.6R2, 22.7R2.1, and 9.1R18.7 and Ivanti Policy Secure versions 22.7R1.1 and 22.7R1.2.
beschreibt (6)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-39712US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39711US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39710US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39709US | —OT erhöht | — | ||
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a… | ||||
| CVE-2024-38656US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-38655US | high7.2 | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacke… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (12)
- BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.6R2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - BehobenPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan