CVE-2024-8963

critical · 9.4Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Added 2024-09-19Remediation due 2024-10-10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

9.4

CVSS

98.6%

EPSS (exploit prob.)

100th

EPSS percentile

2024-09-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
ivanti	endpoint_manager_cloud_services_appliance	4.6
ivanti	endpoint_manager_cloud_services_appliance	4.6
ivanti	endpoint_manager_cloud_services_appliance	4.6

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-8963