Main Vulnerability Database Vulnerabilities #VU100492

Privilege Defined With Unsafe Actions in Ivanti products - CVE-2024-8539

Published: November 14, 2024

Vulnerability identifier: #VU100492

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-8539

CWE-ID: CWE-267

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper authorization checks. A local user can execute arbitrary code with elevated privileges.

Affected software

Ivanti Secure Access Client for Windows
Ivanti Secure Access Client for Linux
Ivanti Secure Access Client for macOS

How to mitigate CVE-2024-8539

Install updates from vendor's website.

Ivanti Secure Access Client for Windows - update to 22.7R4
Ivanti Secure Access Client for Linux - update to 22.7R4
Ivanti Secure Access Client for macOS - update to 22.7R4

External References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Related Security Bulletins