Main
Vulnerability Database
Exploits
ID:10938 - Exploit for CRLF injection in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2024-37404
ID:10938 - Exploit for CRLF injection in Ivanti Connect Secure (formerly Pulse Connect Secure) and Ivanti Policy Secure (formerly Pulse Policy Secure) - CVE-2024-37404
Published: December 4, 2024
Vulnerability identifier: #VU98388
Vulnerability risk: Low
CVE-ID: CVE-2024-37404
CWE-ID: CWE-93
Exploitation vector: Remote access
Vulnerable software:
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Policy Secure (formerly Pulse Policy Secure)
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data in the admin portal. A remote administrator can pass specially crafted data to the application containing CR-LF characters and execute arbitrary code on the target system.
Remediation
Install updates from vendor's website.