Cloud Services Appliance vulnerabilities

4 known vulnerabilities in Cloud Services Appliance from Ivanti. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Cloud Services Application: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-47908Feb 11, 2025IvantiEPSS 22.3%

  OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

• 7.2 High severity

  Cloud Services Application: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2024-11773Dec 10, 2024IvantiEPSS 23.3%

  SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

• 7.2 High severity

  Cloud Services Application: Improper Neutralization of Special Elements used in a Command

  CVE-2024-11772Dec 10, 2024IvantiEPSS 7.65%

  Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

• 7.2 High severity

  Ivanti Cloud Services Appliance OS Command Injection Exploited

  CVE-2024-8190Sep 10, 2024IvantiEPSS 88.5%

  An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.