{"id":"CVE-2024-9379","kind":"vulnerability","aliases":["CVE-2024-9379"],"related":[],"title":"ivanti endpoint manager cloud services appliance: SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker…","description":"Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.\n\nCISA required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","summary":"Ivanti Cloud Services Appliance (CSA) has a SQL injection flaw in its admin web console, present in versions before 5.0.2. An attacker logged in as an administrator can run arbitrary SQL statements against the appliance's database.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2024-10-09T00:00:00+00:00","products":[{"name":"Ivanti Cloud Services Appliance (CSA)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti endpoint manager cloud services appliance","fixed":["5.0.2"],"affected":"< 5.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["csa","exploited","infrastructure","ivanti","self-hosted"],"not_affected_if":["version-5.0.2-or-later"],"how_to_check":null,"fix":"Upgrade CSA to 5.0.2 or later; CISA says CSA 4.6.x is end-of-life and should be removed from service or moved to the 5.0.x line.","status":"open","published_at":"2024-10-08T17:15:56+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:28+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade CSA to 5.0.2 or later; CISA says CSA 4.6.x is end-of-life and should be removed from service or moved to the 5.0.x line.","reach":"network","impact":"high","summary":"Ivanti Cloud Services Appliance (CSA) has a SQL injection flaw in its admin web console, present in versions before 5.0.2. An attacker logged in as an administrator can run arbitrary SQL statements against the appliance's database.","category":"infrastructure","who_cares":["ivanti","csa","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker with admin login runs arbitrary SQL against the appliance database.","analyst_note":"Check Ivanti's advisory for affected version range and a way to confirm the installed CSA version; sources only give 'prior to 5.0.2'.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-5.0.2-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000481,"input_tokens":2909,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':26A,29A '-9379':27A,30A '4.6':126C,141C '5.0':149C '5.0.2':19A,68B,105C 'action':122C 'admin':11A,61B,98C 'administr':75B,114C 'allow':20A,108C 'applianc':6A,52B,83B,89C 'appliance':34A,41A 'arbitrari':78B,117C 'attack':24A,70B,111C 'authent':23A,112C 'cisa':120C 'cloud':4A,32A,39A,50B,87C 'consol':13A,63B,100C 'contain':91C 'csa':16A,35A,42B,53B,90C,125C,140C 'cve':25A,28A 'databas':85B 'end':131C 'end-of-lif':130C 'endpoint':2A,37A 'exploit':43B 'flaw':58B 'host':48B 'infrastructur':44B 'inject':8A,57B,94C 'ivanti':1A,15A,31A,36A,45B,49B,86C,124C 'later':153C 'life':133C 'line':151C 'log':71B 'manag':3A 'manager':38A 'present':64B 'prior':103C 'reach':129C 'remot':22A,110C 'remov':139C 'requir':121C 'run':77B,116C 'self':47B 'self-host':46B 'servic':5A,51B,88C,144C 'services':33A,40A 'solut':156C 'sql':7A,56B,79B,93C,118C 'statement':80B,119C 'status':134C 'support':155C 'upgrad':146C 'urg':137C 'user':135C 'version':18A,66B,102C 'vulner':95C 'web':12A,62B,99C 'x':127C,142C,150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-10-08T17:15:56+00:00","kev":{"dateAdded":"2024-10-09","dueDate":"2024-10-30","requiredAction":"As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-9379","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-9379","severity":null,"published_at":"2024-10-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-9379","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-9379","severity":null,"published_at":"2024-10-08T17:15:56+00:00","modified_at":"2026-10-01T19:17:15+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}