Ivanti Cloud Services Appliance vulnerabilities
7 vulnerabilities
Known vulnerabilities in Ivanti Cloud Services Appliance, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-22460ivanticloud_services_appliance
EPSS score0.34%
Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privileges.CVE-2024-11771ivanticloud_services_applianceEPSS score1.18%
Path traversal in Ivanti CSA before version 5.0.5 allows a remote unauthenticated attacker to access restricted functionality.CVE-2024-11772ivanticloud_services_applianceEPSS score7.65%
Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-11773ivanticloud_services_applianceEPSS score23.45%
SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.CVE-2024-11639ivanticloud_services_applianceEPSS score4.87%
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative accessCVE-2024-47908ivanticloud_services_applianceEPSS score22.33%
OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.CVE-2024-8190ivanticloud_services_applianceKEVEPSS score88.53%
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.