Desktop Server Management
CVE-2024-7572
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from Vendor (3c1d8aa1-5a33-4ea4-8992-aadd6440af75) · only source for this CVE.
CVSS VectorVendor: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files.
AnalysisAI
Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. Insufficient permissions in Ivanti DSM before version 2024.3.5740 allows a local authenticated attacker to delete arbitrary files. Affected products include: Ivanti Desktop \& Server Management. Version information: version 2024.3.5740.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.
More in Desktop Server Management
View allDenial-of-Service (DoS) in Ivanti Service Manager HEAT Remote Control 7.4 due to a buffer overflow in the protocol parse
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to
Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to
DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today