CVE-2024-37400: High severity ivanti pulse connect secure vulnerability
Published Nov 13, 2024
·Updated
An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to trigger an infinite loop, causing a denial of service.
Affected Software
12 affected components
Ivanti Connect Secure<22.7R2.3
Ivanti Connect Secure<22.7
Ivanti Connect Secure=22.7
Ivanti Connect Secure=22.7-r1
Ivanti Connect Secure=22.7-r1.1
Ivanti Connect Secure=22.7-r1.2
Ivanti Connect Secure=22.7-r1.3
Ivanti Connect Secure=22.7-r1.4
Ivanti Connect Secure=22.7-r1.5
Ivanti Connect Secure=22.7-r2
Ivanti Connect Secure=22.7-r2.1
Ivanti Connect Secure=22.7-r2.2
Event History
Nov 13, 2024
CVE Published
via MITRE·01:54 AM
Data Sourced
via MITRE·01:54 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-37400?
CVE-2024-37400 is a medium severity vulnerability allowing denial of service due to an out of bounds read.
2
How do I fix CVE-2024-37400?
To fix CVE-2024-37400, upgrade Ivanti Connect Secure to version 22.7R2.3 or later.
3
Who is affected by CVE-2024-37400?
CVE-2024-37400 affects users of Ivanti Connect Secure versions prior to 22.7R2.3.
4
What can attackers do with CVE-2024-37400?
Attackers exploiting CVE-2024-37400 can cause an infinite loop leading to a denial of service.
5
Is CVE-2024-37400 remote or local?
CVE-2024-37400 can be exploited remotely by an unauthenticated attacker.