Vulnerability · Published Mar 31, 2024 · Assigned by hackerone
CVE-2023-41724
Critical 9.6
In plain English
A critical-severity code injection in Sentry from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 12.8% (higher than 96% of all known vulnerabilities).
Severity (CVSS 3.0)9.6Critical
Exploit odds (30 days)12.8%top 3.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H