CSA (Cloud Services Appliance) vulnerabilities

4 known vulnerabilities in CSA (Cloud Services Appliance) from Ivanti. 4 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  Ivanti Cloud Services Appliance (CSA) OS Command Injection Exploited

  CVE-2024-9380Oct 8, 2024IvantiEPSS 58.3%

  An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.

• 7.2 High severity

  Ivanti Cloud Services Appliance (CSA) SQL Injection Exploited

  CVE-2024-9379Oct 8, 2024IvantiEPSS 44.3%

  SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

• 9.1 Critical severity

  Ivanti Cloud Services Appliance (CSA) Path Traversal Exploited

  CVE-2024-8963Sep 19, 2024IvantiEPSS 98.6%

  Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

• 7.2 High severity

  Ivanti Cloud Services Appliance OS Command Injection Exploited

  CVE-2024-8190Sep 10, 2024IvantiEPSS 88.5%

  An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.