← CVE Radar
CVE-2024-8190Ivanti Cloud Services Appliance OS Command Injection Vulnerability
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
7.2 HIGHEPSS 88.53%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.2 | HIGH | 3.1ivanti (CNA) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Oct 4, 2024
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Details
- CVE ID
- CVE-2024-8190
- Status
- Analyzed
- Assigner (CNA)
- ivanti
- Published
- Sep 10, 2024
- Last modified
- 2026-06-17 08:22 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
IvantiCSA (Cloud Services Appliance)0 version ranges
No version detail published.
References
- forums.ivanti.com https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190
- cisa.gov https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190