CVE-2024-11639

The vulnerability classified as CWE-288 (authentication bypass using alternate path) and CWE-306 (missing authentication for critical function) involves the ability to bypass authentication mechanisms in the administrative web console. An attacker can gain access to protected administrative functions without providing any credentials by exploiting an alternative path or missing identity verification mechanism. The attack is possible remotely over the network without requiring prior access to the system.

An attacker gains full administrative privileges to Ivanti CSA, enabling arbitrary configuration modifications, access to sensitive data, and potential compromise of confidentiality, integrity, and availability of the entire system.

Ivanti CSA must be immediately updated to version 5.0.3 or later. Detailed information is available in the official Ivanti security bulletin at the address indicated in the references. Until the patch is deployed, it is recommended to restrict access to the administrative web console only to trusted IP addresses using a firewall.

Ivanti Cloud Services Appliance (CSA) in versions before 5.0.3