Main Vulnerability Database Vulnerabilities #VU103939

External Control of File Name or Path in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2024-38657

Published: February 13, 2025

Vulnerability identifier: #VU103939

CSH Severity: Low

CVSS v4: 6.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H]

CVE-ID: CVE-2024-38657

CWE-ID: CWE-73

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to write arbitrary files.

The vulnerability exists due to external control of a file name. A remote administrator can write arbitrary files on the system.

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.3
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.4