CVE-2024-9379

MEDIUM6.5

CISA KEV

Published 2024-10-08 · Updated 2026-10-01 · Source 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Description

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

CWE-89CWE-89

CISA Known-Exploited Vulnerability

Product: Ivanti — Cloud Services Appliance (CSA)

Name: Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

Date added: 2024-10-09 · Due: 2024-10-30

Required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-105305
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the minimum authentication level required by a client configuration. This allows an attacker who has stolen a user's password to bypass mandatory multi-factor authentication and gain unauthorized access to the Keycloak Admin REST API.
2026-10-06 · score 5.4
CVE-2026-25274
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
2026-10-06 · score 6.7
CVE-2026-25273
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
2026-10-06 · score 6.7
CVE-2026-25272
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
2026-10-06 · score 6.7
CVE-2026-25270
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
2026-10-06 · score 6.7