Ivanti Security Updates – 09 October 2024

The addressed vulnerabilities could allow the attacker to obtain sensitive information, bypass security restrictions, gain elevated privileges, perform a denial of service attack, conduct SQL injection attacks, or execute arbitrary code and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. Improper Input Validation in The Admin Portal of Ivanti Connect Secure Vulnerability (CVE-2024-37404):

• CVSS: 9.1
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Gain Access

2. Insecure Permissions in Ivanti EPMM Vulnerability (CVE-2024-7612):

• CVSS: 8.8
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

Affected Products:

• Ivanti EPMM.
• Ivanti CSA.
• Ivanti Velocity License Server.
• Ivanti Avalanche.
• Ivanti Connect Secure/Policy Secure