ByteOS Network

NVD Vulnerability Details :

CVE-2024-8963

Analyzed

Source-3c1d8aa1-5a33-4ea4-8992-aadd6440af75

View Known Exploited Vulnerability (KEV) details

Published At-19 Sep, 2024 | 18:15

Updated At-24 Oct, 2025 | 13:55

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2024-09-19	2024-10-10	Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability	As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Date Added: 2024-09-19

Due Date: 2024-10-10

Vulnerability Name: Ivanti Cloud Services Appliance (CSA) Path Traversal Vulnerability

Required Action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive security updates.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.4	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Primary	3.1	9.1	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 9.4

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Type: Primary

Version: 3.1

Base score: 9.1

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CPE Matches

Ivanti Software

>>endpoint_manager_cloud_services_appliance>>4.6

cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*

Ivanti Software

>>endpoint_manager_cloud_services_appliance>>4.6

cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_512:*:*:*:*:*:*

Ivanti Software

>>endpoint_manager_cloud_services_appliance>>4.6

cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:patch_518:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Secondary	3c1d8aa1-5a33-4ea4-8992-aadd6440af75
CWE-22	Primary	nvd@nist.gov

CWE ID: CWE-22

Type: Secondary

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

CWE ID: CWE-22

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963	3c1d8aa1-5a33-4ea4-8992-aadd6440af75	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-4-6-Cloud-Services-Appliance-CVE-2024-8963

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Resource:

Vendor Advisory

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-8963

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History