IDORSSRFAUTH BYPASSJWT FORGERYRACE CONDITIONXXEBROKEN OBJECT-LEVEL AUTHPRIVILEGE ESCALATIONMASS ASSIGNMENTGRAPHQL INTROSPECTION ABUSEIDORSSRFAUTH BYPASSJWT FORGERYRACE CONDITIONXXEBROKEN OBJECT-LEVEL AUTHPRIVILEGE ESCALATIONMASS ASSIGNMENTGRAPHQL INTROSPECTION ABUSE
Impactr Logoimpactr
FeaturesHow it worksEvidencePricingLearnVulnerability DBCompare
  1. Home
  2. Vulnerability Database
  3. CVE-2024-9379
CVE-2024-9379 CISA KEV — actively exploited

Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability

Ivanti — CSA (Cloud Services Appliance)

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

CVSS scoreMedium

6.5

EPSS — exploitation probabilityMedium

43.4%

Vector breakdown

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Published
Oct 8, 2024
Modified
Oct 21, 2025
Added to KEV
Oct 9, 2024
Federal patch due
Oct 30, 2024

CISA required action

As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.

Weakness classification

CWE-89Improper Neutralization of Special Elements used in an SQL Command

Proof-of-concept & exploitation references

Weaponization

Nuclei template

Not found

Metasploit module

Not found

Public repositories whose name or description references CVE-2024-9379, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.

No public GitHub repositories referencing CVE-2024-9379 were found at last check. Absence here is not proof no exploit exists - see the references below for vendor advisories and write-ups.

References

  • forums.ivanti.com

Frequently asked questions

What is CVE-2024-9379?

SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL statements.

How severe is CVE-2024-9379?

CVE-2024-9379 has a CVSS base score of 6.5 out of 10 (CVSS 3.1).

Is CVE-2024-9379 actively exploited in the wild?

Yes. CVE-2024-9379 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Oct 9, 2024, meaning CISA has confirmed evidence of active exploitation.

What is the EPSS score for CVE-2024-9379?

43.4% - meaning FIRST.org's EPSS model estimates a 43.4% probability this vulnerability will be exploited in the wild within 30 days (99% percentile among all scored CVEs).

What type of vulnerability is CVE-2024-9379?

CVE-2024-9379 is classified under CWE-89 (CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')).

Cross-checked against

  • NVD (NIST)
  • MITRE CVE Record
  • CISA KEV
  • FIRST.org EPSS
  • GitHub Advisory Database
  • GitHub public repository search

Impactr finds and proves whether CVE-2024-9379 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.

Join the waitlist
← Vulnerability database
Impactr Logoimpactr

Built by hackers, for the code you ship. Autonomous AI penetration testing for modern web apps and APIs.

© 2026 Impactr

Product

FeaturesCoverageUse casesEvidencePricingWaitlist

Resources

VulnerabilitiesVulnerability databaseGuidesComparisonsGlossaryCWE databaseBy industryBy languageHTTP status codesSecurity headers

Company

ContactTwitterLinkedInGitHub