{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37401",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-12T14:39:20.691415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-12T14:39:24.747Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "lessThan": "22.7R2.1",
              "status": "affected",
              "version": "22.7R2.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T18:52:27.527Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2024-37401",
    "datePublished": "2024-12-11T18:52:27.527Z",
    "dateReserved": "2024-06-08T01:04:07.093Z",
    "dateUpdated": "2024-12-12T14:39:24.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-37401\",\"sourceIdentifier\":\"support@hackerone.com\",\"published\":\"2024-12-12T01:55:20.820\",\"lastModified\":\"2025-07-02T20:07:12.820\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An out-of-bounds read in IPsec of Ivanti Connect Secure before version 22.7R2.1 allows a remote unauthenticated attacker to cause a denial of service.\"},{\"lang\":\"es\",\"value\":\"Una lectura fuera de los l\u00edmites en IPsec de Ivanti Connect Secure anterior a la versi\u00f3n 22.7R2.1 permite que un atacante remoto no autenticado provoque una denegaci\u00f3n de servicio.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"support@hackerone.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*\",\"versionEndExcluding\":\"22.7\",\"matchCriteriaId\":\"A0EC2FCD-5402-4269-B86A-18F8DFB8F2C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F788F6D9-5368-4B8E-BFA0-E8FB3CDADB01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2927A40D-E8A3-4DB6-9C93-04A6C6035C3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1399BBB4-E62B-4FF6-B9E3-6AAC68D4D583\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EAD1423-4477-4C35-BF93-697A2C0697C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"858353BC-12CB-4014-BFCA-DA7B1B3DD4B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"865F72BF-57B2-4B0C-BACE-3500E0AE6751\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*\",\"matchCriteriaId\":\"39E11407-E0C0-454F-B731-7DA4CBC696EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"247E71F8-A03B-4097-B7BF-09F8BF3ED4D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0059C69-4A18-4153-9D9A-5C1B03AD1453\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC523C88-115E-4CD9-A8CB-AE6E6610F7D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3447428E-DBCD-4553-B51D-AC08ECAFD881\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"22.7\",\"matchCriteriaId\":\"FAD0FC91-CA1E-4DC3-A37E-1BF98906D07C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F22B988-2585-4853-9838-AB3746C8B888\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD9BE8C2-43EB-4870-A4B7-267CB17A19F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8915BB2-C1C0-4189-A847-DDB2EF161D62\"}]}]}],\"references\":[{\"url\":\"https://forums.ivanti.com/s/article/December-2024-Security-Advisory-Ivanti-Connect-Secure-ICS-and-Ivanti-Policy-Secure-IPS-Multiple-CVEs\",\"source\":\"support@hackerone.com\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}