https://pwn.watch/t/ivanti-csa Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 11 Oct 2024 00:00:00 GMT https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380 https://pwn.watch/i/ivanti-cloud-services-appliance-zero-days-cve-2024-8190-8963-9379-9380 Fri, 11 Oct 2024 00:00:00 GMT critical <p>Four Ivanti Cloud Services Appliance (CSA) bugs were exploited in 2024: a command injection (CVE-2024-8190), a path traversal admin bypass (CVE-2024-8963), and later a SQL injection and another command injection (CVE-2024-9379, CVE-2024-9380). FortiGuard Incident Response found a suspected nation-state actor chaining them. CSA 4.6 was end-of-life; Ivanti urged upgrading to CSA 5.0. Added to the CISA KEV catalog on 2024-09-13, 2024-09-19, 2024-10-09.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-10-11: FortiGuard Labs details the zero-day chain used against Ivanti CSA (<a href="https://www.fortinet.com/blog/threat-research/burning-zero-days-suspected-nation-state-adversary-targets-ivanti-csa">source</a>)</li><li>2024-10-09: CISA added CVE-2024-9379 to the KEV catalog (federal deadline 2024-10-30) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-10-09: CISA added CVE-2024-9380 to the KEV catalog (federal deadline 2024-10-30) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-8190, CVE-2024-8963, CVE-2024-9379, CVE-2024-9380</p>