CVE-2024-37404
HIGHDescription
Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.
Is your site exposed to CVE-2024-37404?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Affected Products
| Vendor | Product |
|---|---|
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
References
Frequently Asked Questions
What is CVE-2024-37404? +
How severe is CVE-2024-37404? +
What products are affected by CVE-2024-37404? +
How do I check if I'm vulnerable to CVE-2024-37404? +
Related Vulnerabilities
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain …
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user …
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code …
An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the …
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker …
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a …