certfr_avis - certfr-2024-avi-0784

CERTFR-2024-AVI-0784

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans Ivanti Cloud Service Appliance (CSA). Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Ivanti déclare que la vulnérabilité CVE-2024-8190 est activement exploitée dans le cadre d'attaques ciblées, en combinaison avec la vulnérabilité CVE-2024-8963.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Ivanti a publié un correctif de sécurité pour la version 4.6 (Patch 519), mais précise que la branche 4.x est en fin de vie et encourage ses clients à migrer en version 5.0.

Impacted products

	Vendor	Product	Description
	Ivanti	Cloud Service Appliance (CSA)	Cloud Services Appliance versions antérieures à 5.0

References

Title

Publication Time

Tags

Bulletin de sécurité Ivanti	2024-09-10	vendor-advisory
Avis de sécurité CERT-FR CERTFR-2024-AVI-0796 du 20 septembre 2024	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Cloud Services Appliance versions ant\u00e9rieures \u00e0 5.0",
      "product": {
        "name": "Cloud Service Appliance (CSA)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "Ivanti a publi\u00e9 un correctif de s\u00e9curit\u00e9 pour la version 4.6 (Patch 519), mais pr\u00e9cise que la branche 4.x est en fin de vie et encourage ses clients \u00e0 migrer en version 5.0.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-8190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-8190"
    }
  ],
  "initial_release_date": "2024-09-17T00:00:00",
  "last_revision_date": "2024-09-20T00:00:00",
  "links": [
    {
      "title": "Avis de s\u00e9curit\u00e9 CERT-FR CERTFR-2024-AVI-0796 du 20 septembre 2024",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0796/"
    }
  ],
  "reference": "CERTFR-2024-AVI-0784",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-09-17T00:00:00.000000"
    },
    {
      "description": "Ivanti indique que la vuln\u00e9rabilit\u00e9 CVE-2024-8190 est exploit\u00e9e en combinaison avec la vuln\u00e9rabilit\u00e9 CVE-2024-8963.",
      "revision_date": "2024-09-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ivanti Cloud Service Appliance (CSA). Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nIvanti d\u00e9clare que la vuln\u00e9rabilit\u00e9 CVE-2024-8190 est activement exploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es, en combinaison avec la vuln\u00e9rabilit\u00e9 CVE-2024-8963.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ivanti Cloud Service Appliance",
  "vendor_advisories": [
    {
      "published_at": "2024-09-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti",
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190?language=en_US"
    }
  ]
}

CVE-2024-8190 (GCVE-0-2024-8190)

Vulnerability from cvelistv5

Published

2024-09-10 20:33

Modified

2025-07-30 01:36

Severity ?

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

References

URL

Tags

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190

Impacted products

	Vendor	Product	Version
	Ivanti	CSA (Cloud Services Appliance)	Patch: 4.6 Patch 519 Patch: 5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "endpoint_manager_cloud_services_appliance",
            "vendor": "ivanti",
            "versions": [
              {
                "lessThan": "5.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8190",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-14T03:55:56.481320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2024-09-13",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8190"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:36:32.976Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2024-09-13T00:00:00+00:00",
            "value": "CVE-2024-8190 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-16T13:24:41.628Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "CSA (Cloud Services Appliance)",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "4.6 Patch 519",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "5.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability."
            }
          ],
          "value": "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T20:33:44.793Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2024-8190",
    "datePublished": "2024-09-10T20:33:44.793Z",
    "dateReserved": "2024-08-26T19:12:19.826Z",
    "dateUpdated": "2025-07-30T01:36:32.976Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2024-AVI-0784

Vulnerability from certfr_avis

Solutions

CVE-2024-8190 (GCVE-0-2024-8190)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature