CVE-2024-47906

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-267 CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-479077.5A stack-based buffer overflow in IPsec of Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to cause a CVE-2024-479087.2OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privilege CVE-2024-479094.9A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a rem CVE-2024-47917.5A vulnerability classified as critical was found in Contemporary Control System BASrouter BACnet BASRT-B 2.7.2. This vulnerability affects u CVE-2024-479107.2An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. A SonarQube user with the Administrator role can mod CVE-2024-479117.2In SonarSource SonarQube 10.4 through 10.5 before 10.6, a vulnerability was discovered in the authorizations/group-memberships API endpoint CVE-2024-479128.2A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an u CVE-2024-479135.3An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2.CVE-2024-479144.5VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF)CVE-2024-479157.5VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-479167.5Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-479177.5CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')