Pierluigi Paganini
September 20, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Ivanti Cloud Services Appliance path traversal vulnerability CVE-2024-8190 (CVSS score of 9.4) to its .
Ivanti warned of a new Cloud Services Appliance (CSA) vulnerability, tracked as (CVSS score of 9.4), actively exploited in attacks in the wild against a limited number of customers. The vulnerability is a path traversal security issue.
A remote unauthenticated attacker could exploit the vulnerability to access restricted functionality. An attacker could chain the issue with the recently disclosed flaw CVE-2024-8190 to bypass admin authentication and execute arbitrary commands on the appliance.
“Ivanti is disclosing a critical vulnerability in Ivanti CSA 4.6 which was incidentally addressed in the patch released on 10 September (CSA 4.6 Patch 519). Successful exploitation could allow a remote unauthenticated attacker to access restricted functionality.” the advisory. “If CVE-2024-8963 is used in conjunction with an attacker can bypass admin authentication and execute arbitrary commands on the appliance.”
The company note that , and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability.
“We are aware of a limited number of customers who have been exploited by this vulnerability.” added the company.
The company discovered the vulnerability while investigating the exploitation that Ivanti disclosed on 13 September.
“The vulnerability was discovered as we were investigating the exploitation that Ivanti disclosed on 13 September.” continues the advisory. “As we were evaluating the root cause of this vulnerability, we discovered that the issue had been incidentally addressed with some of the functionality removal that had been included in patch 519.”
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by October 10, 2024.
On September 13, 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Ivanti another Cloud Services Appliance OS Command Injection Vulnerability, tracked as CVE-2024-8190 (CVSS score of 7.2), to its .
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, CISA)
