CVE-2024-9379

Katalog CVE

CVSS 7.2 · High KEV · sudah dieksploitasi EPSS 43,8%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada ivanti endpoint manager cloud services appliance. Skor CVSS 3.1 7.2 (High) menurut NVD. Masuk katalog KEV CISA pada 9 Oktober 2024, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

Rincian

Terbit di NVD

8 Oktober 2024

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

EPSS (30 hari)

43,8% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

Masuk KEV

9 Oktober 2024

Tenggat CISA

30 Oktober 2024 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-20... advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9379 pemerintah AS