CVE-2024-11773

Tycho_Jissard

MS-ISACCYBERSECURITYADVISORY-MultipleVulnerabilitiesinIvantiCloudServicesApplication(CSA)CouldAllowforRemoteCodeExecution-PATCHNOW

cytexsmb

Ivanti has issued an urgent warning about three more critical vulnerabilities affecting its Cloud Services Application (CSA), including a perfect 10. CVE-2024-11639 (CVSS 10.0): This max-rating vulnerability allows unauthenticated attackers to bypass authentication mechanisms and gain administrative privileges. CVE-2024-11772 (CVSS 9.1): This flaw enables remote code execution on the CSA server, giving attackers complete control over the system. CVE-2024-11773 (CVSS 9.1): This SQL injection vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to data theft and system compromise. The two 9.1 score vulnerabilities make an attractive prospect for attackers to chain together and cause damage. Ivanti CSA is a prime cyberattack target due to its key role in accessing organizational data and managing IT systems. If compromised, criminals might intercept or manipulate confidential information or other network parts. Given the severity of these vulnerabilities, it is imperative for organizations using Ivanti CSA to prioritize patching. By updating to the latest version, CSA 5.0.3, organizations can mitigate these risks and protect their sensitive data. If immediate patching is not feasible, organizations should implement temporary mitigation measures, such as restricting access to the CSA console and monitoring network traffic for suspicious activity.