Ivanti product security update advisory

Malware News
1

Overview

 

An update has been released to address vulnerabilities in Ivanti products. Users of the affected versions are advised to update to the latest version.

 

Affected Products

 

CVE-2024-7569, CVE2024-7570

  • Ivanti Neurons for ITSM version: ~ 2023.4 (included)

 

 

Resolved Vulnerabilities

 

Information disclosure vulnerability allows an unauthenticated attacker to obtain OIDC client passwords via debug information (CVE-2024-7569)

Improper certificate validation could allow a remote attacker in the MITM location to create a token that could allow access to the ITSM as all users (CVE-2024-7570)

 

Vulnerability Patches
 

 

With the latest update, the following product-specific vulnerability patches have been made available. Please follow the instructions on the Referenced Sites[1] to update to the latest Vulnerability Patches version.

 

 

Referenced Sites

 

[1] Security Advisory: Ivanti Neurons for ITSM (CVE-2024-7569, CVE-2024-7570)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2024-7569-CVE-2024-7570?language=en_US

Article Link: Ivanti product security update advisory – ASEC