{"id":"CVE-2023-41724","published":"2024-03-31T01:45:42Z","modified":"2025-03-25T14:36:27Z","title":"A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute…","vendor":"Ivanti","product":"Sentry","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Sentry","versions":[">= 9.19.0, <= 9.19.0"]}],"description":{"text":"A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. ","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.12844,"percentile":0.96284,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-14","exploitedFirstSeen":"2024-05-14","ransomware":false,"evidence":[{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf","date":"2024-05-14"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2023-41724-Remote-Code-Execution-for-Ivanti-Standalone-Sentry","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-46216","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-46216","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-03-31","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-41724","provenance":"source"},{"date":"2024-05-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":61.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 899 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.26,"detail":"percentile 0.9628"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}