CVE-2024-38655: Critical severity ivanti pulse connect secure vulnerability
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38655?
CVE-2024-38655 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-38655?
To fix CVE-2024-38655, upgrade Ivanti Connect Secure to version 22.7R2.1 or 9.1R18.9, and Ivanti Policy Secure to version 22.7R1.1 or 9.1R18.9.
Who is impacted by CVE-2024-38655?
CVE-2024-38655 impacts remote authenticated users with admin privileges on vulnerable versions of Ivanti Connect Secure and Ivanti Policy Secure.
What type of vulnerability is CVE-2024-38655?
CVE-2024-38655 is classified as an argument injection vulnerability allowing remote code execution.
Can CVE-2024-38655 be exploited remotely?
Yes, CVE-2024-38655 can be exploited remotely by an authenticated attacker with administrative access.