CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL Injection
Remote authenticated admin can execute arbitrary SQL statements in the Ivanti CSA admin console, potentially compromising data integrity and confidentiality.
- Exploited in the wild
- Since 9 Oct 2024
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9379?
CVE-2024-9379 is a medium-severity SQL injection vulnerability in Ivanti CSA (Cloud Services Appliance), published on 8 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
Weakness: CWE-89
Which versions are affected by CVE-2024-9379?
It affects 1 product.
Products include Ivanti Endpoint Manager Cloud Services Appliance.
How do I fix CVE-2024-9379?
No fix has been published for CVE-2024-9379 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Oct 2024.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-9379 being exploited?
Yes. Attackers have exploited CVE-2024-9379 in the wild since at least 9 Oct 2024.
Other vulnerabilities in Ivanti CSA (Cloud Services Appliance)
- CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
- CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal
- CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection
- CVE-2024-9381 Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.
Sources
Also known as GHSA-cp43-973g-2qqg.