CVE-2024-47906 — Ivanti / Connect Secure

CVE-2024-47906

Ivanti / Connect Secure PUBLISHED

Description (CNA)

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

Affected (CNA)

Vendor / product	Versions
Ivanti / Connect Secure	affected 22.4R2 through 22.7R2.2; unaffected 22.7R2.3
Ivanti / Policy Secure	unaffected 22.7R1.2

CWE

CWE-267, CWE-426

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.