The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> Ivanti Cloud Services Appliance path traversal vulnerability CVE-2024-8190<\/a> (CVSS score of 9.4) to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n
Ivanti warned of a new Cloud Services Appliance (CSA) vulnerability, tracked as CVE-2024-8963<\/a> (CVSS score of 9.4), actively exploited in attacks in the wild against a limited number of customers. The vulnerability is a path traversal security issue.<\/p>\n\n\n\n
A remote unauthenticated attacker could exploit the vulnerability to access restricted functionality. An attacker could chain the issue with the recently disclosed flaw CVE-2024-8190<\/a> to bypass admin authentication and execute arbitrary commands on the appliance. <\/p>\n\n\n\n
\u201cIvanti is disclosing a critical vulnerability in Ivanti CSA 4.6 which was incidentally addressed in the patch released on 10 September (CSA 4.6 Patch 519). Successful exploitation could allow a remote unauthenticated attacker to access restricted functionality.\u201d reads<\/strong><\/a> the advisory. \u201cIf CVE-2024-8963 is used in conjunction with CVE-2024-8190<\/a> an attacker can bypass admin authentication and execute arbitrary commands on the appliance.\u201d <\/em><\/p>\n\n\n\n
The company note that CSA 4.6 is End-of-Life<\/a>, and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability. <\/p>\n\n\n\n
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n
CISA orders federal agencies to fix this vulnerability by October 10, 2024.<\/p>\n\n\n\n
On September 13, 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> Ivanti another Cloud Services Appliance OS Command Injection Vulnerability, tracked as CVE-2024-8190<\/a> (CVSS score of 7.2), to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n
Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/p>\n\n\n\n
Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n
(<\/strong>SecurityAffairs<\/strong><\/a> \u2013<\/strong> hacking, CISA)<\/strong>