CVE-2023-41724

2024-03-3102:15:07

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-41724

command injection

ivanti sentry

unauthenticated

threat actor

arbitrary commands

operating system

appliance

network security

8.8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.8%

JSON

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

Affected configurations

NVD

Node

ivantistandalone_sentryRange<9.19.0

CPENameOperatorVersion
ivanti:standalone_sentryivanti standalone sentrylt9.19.0

CPE	Name	Operator	Version
ivanti:standalone_sentry	ivanti standalone sentry	lt	9.19.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Sentry",
    "versions": [
      {
        "version": "9.19.0",
        "status": "affected",
        "lessThanOrEqual": "9.19.0",
        "versionType": "semver"
      }
    ]
  }
]