Cloud Services Appliance
CVE-2024-11639
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
AnalysisAI
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-288. An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access Affected products include: Ivanti Cloud Services Appliance. Version information: before 5.0.3.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Cloud Services Appliance
View allOS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to e
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with ad
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker wit
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted function
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today