CVE-2024-11007 — OS Command Injection in Ivanti Connect Secure

CWE-78 — OS Command Injection3 documents3 sources
Severity
7.2HIGHNVD
CNA9.1
EPSS
17.8%
top 4.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ivanti Connect SecureIvanti Policy Secure
Timeline
PublishedNov 12

Description

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

▶NVDivanti/policy_secure< 22.7+1
▶NVDivanti/connect_secure< 22.7+1

🔴Vulnerability Details

2
GHSA
GHSA-268c-v4f5-27qw: Command injection in Ivanti Connect Secure before version 22↗2024-11-12
▶
CVEList
CVE-2024-11007: Command injection in Ivanti Connect Secure before version 22↗2024-11-12
▶
CVE-2024-11007 — OS Command Injection in Ivanti | cvebase