medium6.5Known exploited
CVE-2024-9379
Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-10-09. Federal due date: 2024-10-30.
As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Impact
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | Endpoint Manager Cloud Services Appliance | before 5.0.2 |