CVE-2024-39709 — Incorrect Permission Assignment in Ivanti Connect Secure

CWE-732 — Incorrect Permission Assignment3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 69.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ivanti Connect SecureIvanti Policy Secure
Timeline
PublishedNov 13

Description

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5ivanti/policy_secure22.7R1 — 22.7R1
▶NVDivanti/policy_secure22.1 — 22.7+3
▶CVEListV5ivanti/connect_secure22.6R2 — 22.6R2
▶NVDivanti/connect_secure21.9 — 22.6+3

🔴Vulnerability Details

2
CVEList
CVE-2024-39709: Incorrect file permissions in Ivanti Connect Secure before version 22↗2024-11-13
▶
GHSA
GHSA-q6jg-9xmc-jq9w: Incorrect file permissions in Ivanti Connect Secure before version 22↗2024-11-13
▶
CVE-2024-39709 — Incorrect Permission Assignment | cvebase