Main Vulnerability Database Vulnerabilities #VU103942

External Control of File Name or Path in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2024-12058

Published: February 13, 2025

Vulnerability identifier: #VU103942

CSH Severity: Low

CVSS v4: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N]

CVE-ID: CVE-2024-12058

CWE-ID: CWE-73

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to read arbitrary files.

The vulnerability exists due to external control of a file name. A remote administrator can read arbitrary files on the system.

Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)

Install updates from vendor's website.

Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.3
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.6