CVE-2024-8190

high · 7.2Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

Added 2024-09-13Remediation due 2024-10-04

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

7.2

CVSS

88.5%

EPSS (exploit prob.)

100th

EPSS percentile

2024-09-10

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
ivanti	cloud_services_appliance	4.6
ivanti	cloud_services_appliance	4.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8190