Critical · 9.1 CVE-2024-11773 EUVD-2024-34196GHSA-xx9r-4wqj-799q

SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to r…

Published Dec 10, 2024 · Updated Dec 14, 2024 · Assigned by ivanti

Vendor: ivanti Product: Cloud Services Application Category: Network devices

Description

SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

Affected products

Vendor	Product	Affected	Fixed
Ivanti	Cloud Services Application	—	5.0.3

Advisories 2

NCSC-2024-0486 Kwetsbaarheden verholpen in Ivanti Cloud Security Appliance NCSC-NL (Netherlands) · Dec 11, 2024
WID-SEC-2024-3653 Ivanti Cloud Services Appliance: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 10, 2024

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-11639-CVE-2024-11772-CVE-2024-11773

CNA	v3.1	9.1
EUVD	v3.1	9.1