Paper/Archive/CVE-2021-44529

CVE-2021-44529

ivanti endpoint_manager_cloud_services_appliance — Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

KEV · due 15 Apr ransomware use EPSS 99%public exploit SSVC act CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.9.999 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

Affected

ProductAffectedFixed inSource

Ivanti EPM4.6.0-512–CNA

endpoint_manager_cloud_services_appliance≤ 4.6_patch_512–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/SA-2021-12-02 refpacketstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html refpacketstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529 kevcisa.gov/known-exploited-vulnerabilities-catalog