CVE-2024-8539

Published: Nov 12, 2024Modified: Jan 17, 2025

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

Improper authorization in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker to modify sensitive configuration files.

Affected (5)

Products: Ivanti: Secure Access Client

Ivanti

1 product

Secure Access Client

Configuration A

5 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Ivanti Secure Access Client	Before 22.7
Ivanti Secure Access Client	Version 22.7
Ivanti Secure Access Client	Version 22.7 r1.1
Ivanti Secure Access Client	Version 22.7 r1
Ivanti Secure Access Client	Version 22.7 r2

Running on/with	Platform Versions
Apple Macos	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions

Related CWEs

CWE-267

Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

References (1)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

Timeline

No history available yet.