CVE-2024-11597

Summary

Under specific circumstances, insecure permissions in Ivanti Performance Manager before version 2024.3 HF1, 2024.1 HF1, or 2023.3 HF1 allows a local authenticated attacker to achieve local privilege escalation.

Affected Software

VendorProductVersion RangeStatus
IvantiPerformance Manager2024.3 HF1unaffected
IvantiPerformance Manager2024.1 HF1unaffected
IvantiPerformance Manager2023.3 HF1unaffected

Weaknesses

  • CWE-276: CWE-276 Incorrect Default Permissions

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References