Lucene search

HackeroneCVELIST:CVE-2023-41724

HistoryMar 31, 2024 - 1:45 a.m.

CVE-2023-41724

2024-03-3101:45:42

hackerone

www.cve.org

cve-2023-41724

ivanti sentry

command injection

arbitrary commands

unauthenticated threat actor

operating system

appliance

network

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.5%

JSON

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Sentry",
    "versions": [
      {
        "version": "9.19.0",
        "status": "affected",
        "lessThanOrEqual": "9.19.0",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.5%

JSON

Related for CVELIST:CVE-2023-41724