CVE-2024-38656

Critical

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a…

hackerone·CWE-88·Published 2024-11-13

CVSS

9.1

EPSS

0.02

KEV

Exploits

cve.orgen

224 chars

Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

NVDen

224 chars

NVDes

263 chars

La inyección de argumentos en Ivanti Connect Secure anterior a la versión 22.7R2.2 y 9.1R18.9 y en Ivanti Policy Secure anterior a la versión 22.7R1.2 permite que un atacante remoto autenticado con privilegios de administrador logre la ejecución remota de código.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
3.0	Primary	cve.org	9.1	—	—	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
3.0	Primary	cve.org	9.1	—	—	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
3.0	Secondary	NVD	9.1	2.3	6.0	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
3.1	Primary	cve.org	9.1	—	—	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
3.1	Secondary	NVD	9.1	2.3	6.0	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H