CVE-2024-38657: Critical severity ivanti pulse connect secure vulnerability
External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38657?
CVE-2024-38657 is classified as a high-severity vulnerability due to its potential for arbitrary file writing by an authenticated attacker.
Who is affected by CVE-2024-38657?
CVE-2024-38657 affects Ivanti Connect Secure versions before 22.7R2.4 and Ivanti Policy Secure versions before 22.7R1.3.
How do I fix CVE-2024-38657?
To fix CVE-2024-38657, upgrade Ivanti Connect Secure to version 22.7R2.4 or later and Ivanti Policy Secure to version 22.7R1.3 or later.
What type of attack does CVE-2024-38657 enable?
CVE-2024-38657 enables a remote authenticated attacker with admin privileges to write arbitrary files on the system.
Is authentication required to exploit CVE-2024-38657?
Yes, exploiting CVE-2024-38657 requires the attacker to be an authenticated user with admin privileges.