Main Vulnerability Database Vulnerabilities #VU100508

Race condition in Ivanti products - CVE-2024-29211

Published: November 14, 2024

Vulnerability identifier: #VU100508

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29211

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition. A local user can exploit the race and escalate privileges on the system.

Affected software

Ivanti Secure Access Client for Windows
Ivanti Secure Access Client for macOS
Ivanti Secure Access Client for Linux

How to mitigate CVE-2024-29211

Install updates from vendor's website.

Ivanti Secure Access Client for Windows - update to 22.7R4
Ivanti Secure Access Client for macOS - update to 22.7R4
Ivanti Secure Access Client for Linux - update to 22.7R4

External References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Related Security Bulletins