CVE-2024-11007: OS Command Injection
Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2024-11007?
CVE-2024-11007 is a command injection vulnerability in Ivanti Connect Secure and Ivanti Policy Secure that allows remote authenticated attackers with admin privileges to execute arbitrary code.
What is the severity of CVE-2024-11007?
CVE-2024-11007 is considered a high-severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-11007?
To fix CVE-2024-11007, update Ivanti Connect Secure to version 22.7R2.1 or later and Ivanti Policy Secure to version 22.7R1.1 or later.
Which versions of Ivanti products are affected by CVE-2024-11007?
CVE-2024-11007 affects Ivanti Connect Secure versions before 22.7R2.1 and Ivanti Policy Secure versions before 22.7R1.1, but is not applicable to version 9.1Rx.
Can CVE-2024-11007 be exploited without authenticated access?
No, CVE-2024-11007 requires an attacker to have remote authenticated access with admin privileges to exploit the vulnerability.