CVEvulnerability

CVE-2023-41724

8.8 HIGH Published 2024-03-31 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2024-03-31
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected]): 9.6 CRITICAL — CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-77, CWE-94

Description

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

Affected configurations

• ivanti standalone sentry (< 9.19.0)

Weakness · CWE (2)

CWE-77 Improper Neutralization of Special Elements used in a Command weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry Patch, Vendor Advisory
https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry Patch, Vendor Advisory

CVE-2023-41724

Description

Affected configurations

Related

Weakness · CWE (2)

References