Privilege Defined With Unsafe Actions in Ivanti products - CVE-2024-8539
Published: November 14, 2024
Vulnerability identifier: #VU100492
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-8539
CWE-ID: CWE-267
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor: Ivanti
Affected software:
Ivanti Secure Access Client for Windows
Ivanti Secure Access Client for Linux
Ivanti Secure Access Client for macOS
Ivanti Secure Access Client for Windows
Ivanti Secure Access Client for Linux
Ivanti Secure Access Client for macOS
Detailed vulnerability description
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to improper authorization checks. A local user can execute arbitrary code with elevated privileges.
How to mitigate CVE-2024-8539
Install updates from vendor's website.