CVE-2024-39709

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39709
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
Configurations

No configuration.

History

23 Nov 2024, 21:15

Type Values Removed Values Added
Summary (en) Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 and Ivanti Policy Secure before version 22.6R1 allow a local authenticated attacker to escalate their privileges. (en) Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

13 Nov 2024, 19:35

Type Values Removed Values Added
CWE CWE-732

13 Nov 2024, 17:01

Type Values Removed Values Added
Summary
  • (es) Los permisos de archivo incorrectos en Ivanti Connect Secure anterior a la versión 22.6R2 y en Ivanti Policy Secure anterior a la versión 22.6R1 permiten que un atacante autenticado local aumente sus privilegios.

13 Nov 2024, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-13 02:15

Updated : 2024-11-23 21:15

NVD link : CVE-2024-39709

Mitre link : CVE-2024-39709

CVE.ORG link : CVE-2024-39709

JSON object : View

Products Affected

No product.

CWE
CWE-732

Incorrect Permission Assignment for Critical Resource