CVE-2021-44529

CRITICALCISA KEV

9.8

Description

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/8/2021

Derniere modification11/3/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurIvanti

ProduitEndpoint Manager Cloud Service Appliance (EPM CSA)

Nom vulnerabiliteIvanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability

Date ajout KEV2024-03-25

Date limite remediation2024-04-15

Utilise dans ransomwareKnown

Produits affectes

ivanti:endpoint_manager_cloud_services_appliance

Faiblesses (CWE)

CWE-94CWE-94

References

http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html(support@hackerone.com)

http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html(support@hackerone.com)

https://forums.ivanti.com/s/article/SA-2021-12-02(support@hackerone.com)

http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

https://forums.ivanti.com/s/article/SA-2021-12-02(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.