CVE-2024-38649: High severity ivanti pulse connect secure vulnerability
Published Nov 13, 2024
·Updated
An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated attacker to cause a denial of service.
Affected Software
12 affected components
Ivanti Connect Secure<22.7R2.1
Ivanti Connect Secure<9.1
Ivanti Connect Secure>=21.9<22.7
Ivanti Connect Secure=9.1
Ivanti Connect Secure=22.7
Ivanti Connect Secure=22.7-r1
Ivanti Connect Secure=22.7-r1.1
Ivanti Connect Secure=22.7-r1.2
Ivanti Connect Secure=22.7-r1.3
Ivanti Connect Secure=22.7-r1.4
Ivanti Connect Secure=22.7-r1.5
Ivanti Connect Secure=22.7-r2
Event History
Nov 13, 2024
CVE Published
via MITRE·01:54 AM
Data Sourced
via MITRE·01:54 AM
DescriptionSeverity
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-38649?
CVE-2024-38649 is classified as a high severity vulnerability due to its potential to cause a denial of service.
2
How do I fix CVE-2024-38649?
To mitigate CVE-2024-38649, upgrade Ivanti Connect Secure to version 22.7R2.1 or later.
3
Who is impacted by CVE-2024-38649?
CVE-2024-38649 affects users of Ivanti Connect Secure prior to version 22.7R2.1.
4
Can CVE-2024-38649 be exploited remotely?
Yes, CVE-2024-38649 can be exploited by a remote unauthenticated attacker.
5
What kind of vulnerability is CVE-2024-38649?
CVE-2024-38649 is an out-of-bounds write vulnerability in the IPsec implementation of Ivanti Connect Secure.