Vulnerability · Published Oct 18, 2024 · Assigned by hackerone

CVE-2024-29213

High 7.8

In plain English

A high-severity incorrect authorization in DSM from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.0)7.8High

Exploit odds (30 days)0.2%top 86.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.

Affected products (as reported)

Vendor	Product	Versions
Ivanti	DSM	2024.2 – before 2024.2

Weakness: CWE-863 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-29213