Cloud Services Appliance
CVE-2024-11772
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
AnalysisAI
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Affected products include: Ivanti Cloud Services Appliance. Version information: version 5.0.3.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.
More in Cloud Services Appliance
View allOS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to e
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with ad
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remo
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted function
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today