CVE-2024-8963

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963 ; https://nvd.nist.gov/vuln/detail/CVE-2024-8963

Remediation deadline: October 10, 2024

Description

Ivanti Cloud Services Appliance (CSA) contains a path traversal vulnerability that could allow a remote, unauthenticated attacker to access restricted functionality. If CVE-2024-8963 is used in conjunction with CVE-2024-8190, an attacker could bypass admin authentication and execute arbitrary commands on the appliance.

Timeline

Published:September 19th, 2024 12:00 AM

Last modified:September 19th, 2024 12:00 AM

Added to KEV:September 19th, 2024

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

Ivanti

Products

Cloud Services Appliance (CSA)

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute