BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2024-9380Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability

An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

7.2 HIGHEPSS 58.32%⚡ Known Exploited (CISA KEV)NVD: Analyzed

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
7.2HIGH3.1ivanti (CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Oct 30, 2024

As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.

Details

CVE ID
CVE-2024-9380
Status
Analyzed
Assigner (CNA)
ivanti
Published
Oct 8, 2024
Last modified
2026-06-17 08:24 UTC
Weaknesses
  • CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE-78

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:51 UTC.