Paper/Archive/CVE-2023-41724

CVE-2023-41724

Ivanti Sentry — A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on t…

EPSS 13%CVSS 9.6

critical.is priorityof 100

CVSS 9.6 (CNA)9.6 / 10 × 3028.8 Not in CISA KEV+300.0 EPSS percentile 96.3.963 × 2019.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

Affected

ProductAffectedFixed inSource

Sentry9.19.0 – 9.19.0–CNA

sentry≤ 9.19.0–CISA-ADP

Scores by source

hackerone (CNA)9.6CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry