CVE-2024-38657

Summary

CVE-2024-38657 is a newly disclosed vulnerability affecting Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3. This issue grants remote authenticated attackers with admin privileges the ability to write arbitrary files outside of intended directories, due to a flaw in the handling of external file names. This vulnerability poses a significant risk as it could be exploited to execute malicious code or gain unauthorized access to sensitive data. To mitigate this threat, it is strongly recommended that affected organizations upgrade to the latest versions of Ivanti Connect Secure and Ivanti Policy Secure as soon as possible.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.