CVE-2024-9842

Published: Nov 12, 2024Modified: Jan 17, 2025

3.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.8 / Impact: 1.4

Source: NVD

Description

Incorrect permissions in Ivanti Secure Access Client before version 22.7R4 allows a local authenticated attacker to create arbitrary folders.

Affected (6)

Products: Ivanti: Secure Access Client

1 product

Secure Access Client

Configuration A

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ivanti Secure Access Client	Before 22.7
Ivanti Secure Access Client	Version 22.7
Ivanti Secure Access Client	Version 22.7 r1.1
Ivanti Secure Access Client	Version 22.7 r1
Ivanti Secure Access Client	Version 22.7 r2
Ivanti Secure Access Client	Version 22.7 r3

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Privilege Defined With Unsafe Actions

A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

Timeline

No history available yet.