CVE-2024-47906 — Privilege Defined With Unsafe Actions in Ivanti Connect Secure

CWE-267 — Privilege Defined With Unsafe ActionsCWE-426 — Untrusted Search Path3 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.4%
top 41.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Ivanti Connect SecureIvanti Policy Secure
Timeline
PublishedNov 12

Description

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5ivanti/connect_secure22.4R2 — 22.7R2.2

🔴Vulnerability Details

2
GHSA
GHSA-wp5x-8wxv-j7j2: Excessive binary privileges in Ivanti Connect Secure which affects versions 22↗2024-11-12
▶
CVEList
CVE-2024-47906: Excessive binary privileges in Ivanti Connect Secure before version 22↗2024-11-12
▶
CVE-2024-47906 — Privilege Defined With Unsafe Actions | cvebase