CVE-2024-8190

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 88,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada ivanti cloud services appliance. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 13 September 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

Rincian

Terbit di NVD

10 September 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

88,5% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Ivanti Cloud Services Appliance OS Command Injection Vulnerability

Masuk KEV

13 September 2024

Tenggat CISA

4 Oktober 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190 advisory vendor
• https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190 pemerintah AS