Known vulnerabilities in Ivanti Cloud Services Appliance (CSA)

Vendor: Ivanti
Software: Ivanti Cloud Services Appliance (CSA)
Software CPE: cpe:2.3:a:ivanti:ivanti_cloud_services_appliance:*:*:*:*:*:*:*:*
Website: https://www.ivanti.com/
Total vulnerabilities: 10
Public exploits: 2
Known exploited (KEV): 5
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Ivanti Cloud Services Appliance (CSA) Ivanti Cloud Services Appliance (CSA) is affected by 10 known vulnerabilities: 2 critical, 4 high, 1 medium, 3 low Critical High Medium Low

Vulnerabilities (10)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU103890 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-11771		 CWE-22 Medium
No
No
 5.0.5 12.02.2025 SB2025021217
#VU103889 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-47908		 CWE-78 Low
No
No
 5.0.5 12.02.2025 SB2025021217
#VU101680 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-11773		 CWE-89 Low
No
No
 5.0.3 11.12.2024 SB2024121177
#VU101679 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-11772		 CWE-78 Low
No
No
 5.0.3 11.12.2024 SB2024121177
#VU101678 - Authentication Bypass Using an Alternate Path or Channel
CVE-2024-11639		 CWE-288 High
No
No
 5.0.3 11.12.2024 SB2024121177
#VU98153 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-9381		 CWE-22 High
No
Exploited
 5.0.2 08.10.2024 SB2024100852
#VU98152 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-9380		 CWE-78 High
No
Exploited
 5.0.2 08.10.2024 SB2024100852
#VU98151 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2024-9379		 CWE-89 High
No
Exploited
 5.0.2 08.10.2024 SB2024100852
#VU97617 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2024-8963		 CWE-22 Critical
Available
Exploited
 4.6 Patch 519 19.09.2024 SB2024091969
#VU97119 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2024-8190		 CWE-78 Critical
Available
Exploited
 4.6 Patch 519 10.09.2024 SB2024091101