Actively exploited · Published Sep 19, 2024 · Assigned by ivanti
CVE-2024-8963
Critical 9.4 Exploited
In plain English
A critical-severity path traversal in CSA (Cloud Services Appliance) from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on September 19, 2024). The chance it is exploited in the next 30 days is estimated at 98.6% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
CISA guidance
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Federal agencies must remediate by Oct 10, 2024.
Official description
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | CSA (Cloud Services Appliance) | see references |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L