Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

Ivanti Cloud Services Appliance version prior to 4.6 patch 5.19 are affected by a vulnerability allowing an unauthenticated remote attacker to access restricted functionality via a specially crafted request

The version of Ivanti Endpoint Manager Cloud Services Appliance running on the remote host is prior to 4.6 Patch 519. It is, therefore, affected by multiple vulnerabilities:

  - An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a     remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to     exploit this vulnerability. CVE-2024-8190)

  - Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted     functionality. (CVE-2024-8963)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number.

ID	Name	Product	Family	Severity
114513	Ivanti Cloud Services Appliance < 4.6 patch 519 Path Traversal	Web App Scanning	Component Vulnerability	critical
207345	Ivanti Endpoint Manager Cloud Services Appliance < 4.6 Patch 519 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2024-8963

critical

Tenable Plugins

critical

critical