CVE-2024-39709

Published: Nov 13, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: support@hackerone.com (Secondary)

Description

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

Affected (9)

Products: Ivanti: Connect Secure, Policy Secure

Ivanti

2 products

Connect Secure

Policy Secure

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Ivanti Connect Secure	version < 9.1
Ivanti Connect Secure	21.9 ≤ version < 22.6
Ivanti Connect Secure	Version 22.6
Ivanti Connect Secure	Version 22.6 r1
Ivanti Connect Secure	Version 9.1
Ivanti Policy Secure	22.1 ≤ version < 22.7
Ivanti Policy Secure	version < 9.1
Ivanti Policy Secure	Version 22.7
Ivanti Policy Secure	Version 9.1

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Source: support@hackerone.com

Vendor Advisory

Timeline

No history available yet.