Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-10-10. As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 IVANTI CSA ZERO-DAY CHAIN IN CISA KEV! 🛡️⚡ Actively exploited chain pairs path traversal auth bypass (CVE-2024-8963) with command injection (CVE-2024-8190) for root webshells. 👉 Analysis: https://sh3llc0d3.com/blog/ivanti-csa-46-zero-day-chain-cisa-adds-actively-weaponized-cve-2024-8963-and-cve-2024-8190-to-kev-catalog/ #sh3llc0d3 #shellcode #Ivanti #ZeroDay #CISA
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ivanti | endpoint_manager_cloud_services_appliance | 4.6 | - | - |
| App | ivanti | endpoint_manager_cloud_services_appliance | 4.6 | - | - |
| App | ivanti | endpoint_manager_cloud_services_appliance | 4.6 | - | - |