IT software company Ivanti on Wednesday announced patches for two critical-severity vulnerabilities in Standalone Sentry and Neurons for ITSM that could lead to command execution.
Tracked as CVE-2023-41724 (CVSS score of 9.6) and described as a remote code execution issue, the Standalone Sentry bug allows unauthenticated attackers to execute arbitrary commands.
“An unauthenticated threat actor can execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network,” Ivanti notes in its advisory.
The issue affects all supported iterations of Standalone Sentry (versions 9.17.0, 9.18.0, and 9.19.0). Older releases are also at risk and users should upgrade to a supported version, Ivanti says.
The Ivanti Neurons for ITSM vulnerability is tracked as CVE-2023-46808 (CVSS score of 9.9) and described as a file write issue that can be exploited remotely.
“An authenticated remote user can perform file writes to the ITSM server. Successful exploitation can be used to write files to sensitive directories which may allow attackers execution of commands in the context of a web application’s user,” Ivanti explains in its advisory.
Affected supported versions of Ivanti Neurons for ITSM include 2023.3, 2023.2 and 2023.1. Users of unsupported iterations are advised to upgrade to a supported release. According to Ivanti, all Ivanti Neurons for ITSM cloud landscapes have been patched against the flaw.
Standalone Sentry and Ivanti Neurons for ITSM users can download the available patches via their respective download portals.
Both vulnerabilities were identified towards the end of 2023 but, because neither is actively exploited, Ivanti did not want to disclose them until a fix was available, “so that customers have the tools they need to protect their environment,” the company says.
Ivanti customers are encouraged to apply the available patches as soon as possible, as vulnerabilities in the company’s products are often targeted in attacks.
Related: Governments Urge Organizations to Hunt for Ivanti VPN Attacks
Related: Ivanti Vulnerability Exploited to Deliver New ‘DSLog’ Backdoor
Related: Exploitation of Another Ivanti VPN Vulnerability Observed
