Ivanti CSA (Cloud Services Appliance)
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-22460 | fixed in 5.0.5 | Default credentials in Ivanti Cloud Services Application before version 5.0.5 allows a local authenticated attacker to escalate their privil | HIGH 7.8 | 0.3 % | ||
| CVE-2024-9381 | fixed in 5.0.2 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. | HIGH 7.2 | 16 % | ||
| CVE-2024-9380 | fixed in 5.0.2 | An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker wit | HIGH 7.2 | 58 % | KEV | |
| CVE-2024-9379 | fixed in 5.0.2 | SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to ru | HIGH 7.2 | 44 % | KEV | |
| CVE-2024-8963 | fixed in 4.6 Patch 519, 5.0 | Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. | CRITICAL 9.4 | 99 % | KEV | |
| CVE-2024-8190 | fixed in 4.6 Patch 519, 5.0 | An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated att | HIGH 7.2 | 89 % | KEV |