{"id":"CVE-2024-11634","published":"2024-12-10T18:48:29Z","modified":"2024-12-14T04:55:16Z","title":"Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2…","vendor":"Ivanti","product":"Connect Secure","tier":"tail","description":{"text":"Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01835,"percentile":0.78844,"provenance":"source"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs","tags":[]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":15.77},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"ivanti","affectedVersions":[{"vendor":"Ivanti","product":"Connect Secure","versions":["all versions"]},{"vendor":"Ivanti","product":"Policy Secure","versions":["all versions"]}],"euvd":{"id":"EUVD-2024-34148","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-ivanti-connect-secure-cwe-77"}}