Detections
Analytics

Ivanti Virtual Traffic Manager (vTM) 22.2 < 22.2R1 / 22.3 < 22.3R3 / 22.5 < 22.5R2 / 22.6 < 22.6R2 / 22.7 < 22.7R2 Authentication Bypass (CVE-2024-7593)

critical Nessus Plugin ID 205446

Language:

Synopsis

An application running on the remote web server is affected by an authentication bypass vulnerability.

Description

The version of Ivanti Virtual Traffic Manager (vTM) running on the remote host is 22.2 prior to 22.2R1, 22.3 prior to 22.3R3, 22.5 prior to 22.5R2, 22.6 prior to 22.6R2, or 22.7 prior to 22.7R2. It is, therefore, affected by an authentication bypass vulnerability:

 - Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. (CVE-2024-7593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Ivanti Virtual Traffic Manager (vTM) version 22.2R1, 22.3R3, 22.5R2, 22.6R2, or 22.7R2 or later.

See Also

http://www.nessus.org/u?adb95be6

https://www.exploit-db.com/exploits/52062

Plugin Details

Severity: Critical

ID: 205446

File Name: ivanti_virtual_traffic_manager_CVE-2024-7593.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 8/13/2024

Updated: 8/14/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-7593

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:pulsesecure:virtual_traffic_manager, x-cpe:/a:ivanti:virtual_traffic_manager

Required KB Items: installed_sw/Ivanti Virtual Traffic Manager

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/26/2024

Vulnerability Publication Date: 8/3/2024

Reference Information

CVE: CVE-2024-7593