CVE-2024-8190
Ivanti — Ivanti Cloud Services Appliance OS Command Injection Vulnerability
Ivanti · CWE-78 — Operating system command injection · in CISA KEV since 2024-09-13
EVRS 81 of 100 Urgent
Patch This Cycle
Rank 561 of 2,960 tracked
Why it scores 81
Evidence available: 6 of 7 signalsListed in the CISA KEV catalog, and an EPSS probability of 0.885.
- CISA KEVApplied
- RansomwareDid not apply
- Vendor exploitationDid not apply
- EPSSApplied
- Microsoft Exploitability IndexNot applicable
- Pre-patch disclosureNo data
- KEV recencyDid not apply
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Pre-patch disclosure. Why some signals show no data
Fix
No fixed version identified yetCISA required action
- forums.ivanti.com/…/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190
- nvd.nist.gov/…/CVE-2024-8190
Affected versions
- cloud services appliance
4.6
Remediation
As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 7.2 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | 0.885 (99.78th pctl) | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Confirmed | CISA KEV |
| Ransomware campaign useWhether CISA has seen ransomware operators use it. | Unknown or none | CISA KEV |
| CISA remediation deadlineThe date US federal agencies must have fixed or mitigated it. | 2024-10-04 · KEV since 2024 · listed over a year | CISA KEV |
| Public exploit moduleA module existing is not the same as active exploitation. | None known | Metasploit |
| EUVD cross-referenceENISA's record: CVSS 7.2 (v3.1), assigned by ivanti. | Listed | ENISA EUVD |
Description
NVDAn OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.
What CISA says to do