This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ivanti fixes 49 vulnerabilities
Ivanti is fixing 49 vulnerabilities in its products. The most severe of them are listed below; others can be found at [1][2][3]. Products and their fixed versions: Ivanti Avalanche - 6.4.6 Ivanti Endpoint Manager (EPM) - 2024 November Security Update, 2022 SU6 November Security Update Ivanti Connect Secure (ICS) - 22.7R2.3 Ivanti Policy Secure (IPS) - 22.7R1.2
Allows an unauthenticated remote attacker, due to a null pointer dereference in Ivanti Avalanche, to carry out a DoS attack [1].
The vulnerability is present in product:
- Ivanti Avalanche; >=6, <6.4.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-50317 at cve.org, NVD
- CVE-2024-50318 at cve.org, NVD
- CWE-476: NULL Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated remote attacker, due to an infinite loop in Ivanti Avalanche, to carry out a DoS attack [1].
The vulnerability is present in product:
- Ivanti Avalanche; >=6, <6.4.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
More information:
- CVE-2024-50319 at cve.org, NVD
- CVE-2024-50320 at cve.org, NVD
- CVE-2024-50321 at cve.org, NVD
- CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated remote attacker, through an out-of-bounds buffer read in Ivanti Avalanche, to obtain potentially sensitive information without authorization [1].
The vulnerability is present in product:
- Ivanti Avalanche; >=6, <6.4.6;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-50331 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated remote attacker to execute code in Ivanti EPM [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-50330 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated remote attacker to execute code in Ivanti EPM using social engineering methods [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-50329 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated local attacker to execute code in Ivanti EPM using social engineering methods [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-34787 at cve.org, NVD
- CVE-2024-50322 at cve.org, NVD
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an unauthenticated local attacker to execute code in Ivanti EPM using social engineering methods [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-50323 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an authenticated remote attacker with administrator privileges to execute code in Ivanti EPM [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-32839 at cve.org, NVD
- CVE-2024-32841 at cve.org, NVD
- CVE-2024-32844 at cve.org, NVD
- CVE-2024-32847 at cve.org, NVD
- CVE-2024-34780 at cve.org, NVD
- CVE-2024-37376 at cve.org, NVD
- CVE-2024-34781 at cve.org, NVD
- CVE-2024-34782 at cve.org, NVD
- CVE-2024-34784 at cve.org, NVD
- CVE-2024-50326 at cve.org, NVD
- CVE-2024-50327 at cve.org, NVD
- CVE-2024-50328 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an authenticated remote attacker with administrator privileges to execute code in ICS and IPS [3].
The vulnerability is present in products:
- Ivanti Connect Secure; >=22.1R1, <22.7R2.3; >=9.1R1, <9.1R18.9;
- Ivanti Policy Secure; >=22.1R1, <22.7R1.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-38655 at cve.org, NVD
- CVE-2024-38656 at cve.org, NVD
- CVE-2024-39710 at cve.org, NVD
- CVE-2024-39711 at cve.org, NVD
- CVE-2024-39712 at cve.org, NVD
- CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Allows an authenticated remote attacker with administrator privileges to execute code in ICS and IPS [3].
The vulnerability is present in products:
- Ivanti Connect Secure; >=22.1R1, <22.7R2.1;
- Ivanti Policy Secure; >=22.1R1, <22.7R1.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-11005 at cve.org, NVD
- CVE-2024-11006 at cve.org, NVD
- CVE-2024-11007 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 11. 2024.
Links
- [1] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-Multiple-CVEs-Q4-2024-Release
- [2] https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
- [3] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
By CESNET, z.s.p.o. Michaela Ručková on 28. 11. 2024.