CVE-2024-9380 Ivanti Cloud Services Appliance (CSA) OS Command Injection
Remote authenticated admin can execute arbitrary OS commands via the web console, requiring an upgrade to mitigate.
- Exploited in the wild
- Since 9 Oct 2024
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9380?
CVE-2024-9380 is a high-severity command injection vulnerability in Ivanti CSA (Cloud Services Appliance), published on 8 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.
Which versions are affected by CVE-2024-9380?
It affects 1 product.
Products include Ivanti Endpoint Manager Cloud Services Appliance.
How do I fix CVE-2024-9380?
No fix has been published for CVE-2024-9380 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Oct 2024.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-9380 being exploited?
Yes. Attackers have exploited CVE-2024-9380 in the wild since at least 9 Oct 2024.
Other vulnerabilities in Ivanti CSA (Cloud Services Appliance)
- CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
- CVE-2024-8963 Ivanti Cloud Services Appliance (CSA) Path Traversal
- CVE-2024-9379 Ivanti Cloud Services Appliance (CSA) SQL Injection
- CVE-2024-9381 Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions.
Sources
Also known as GHSA-v7hg-q674-723g.