{"metadata": {"vulnerability": "cve-2024-9381", "count": 30, "kinds": {"milestone": 9, "sighting": 5, "kev": 0, "other": 16}}, "data": [{"timestamp": "2024-09-30T21:10:37.315Z", "date_only": false, "value": "2024-09-30T21:10:37.315Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-10-07T00:00:00Z", "date_only": true, "value": "2024-10-07", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0851", "record": "CERTFR-2024-AVI-0851", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2024-10-08T00:00:00Z", "date_only": true, "value": "2024-10-08", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0851", "record": "CERTFR-2024-AVI-0851", "field": "vendor_advisories.1.published_at", "linked_record": true}, {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / ivanti", "record": "cve-2024-9381", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-10-08T17:15:57Z", "date_only": false, "value": "2024-10-08T17:15:57Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3QX8-772M-X3F3", "record": "GHSA-3QX8-772M-X3F3", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2024-10-08T17:15:57.183Z", "date_only": false, "value": "2024-10-08T17:15:57.183", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9381", "record": "FKIE_CVE-2024-9381", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-10-08T18:33:14Z", "date_only": false, "value": "2024-10-08T18:33:14Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3QX8-772M-X3F3", "record": "GHSA-3QX8-772M-X3F3", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-10-08T18:33:14Z", "date_only": false, "value": "2024-10-08T18:33:14Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3QX8-772M-X3F3", "record": "GHSA-3QX8-772M-X3F3", "field": "modified", "linked_record": true}, {"timestamp": "2024-10-08T18:43:40Z", "date_only": false, "value": "2024-10-08T18:43:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/5704", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "d695c946-5bc4-4dba-aabf-01d6b714e1b5", "content": "\u26a0\ufe0f WARNING: Ivanti\u2019s CSA is under attack! Three new zero-day vulnerabilities are being actively exploited in the wild. \n \nThese flaws, CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, allow attackers to bypass restrictions, execute arbitrary SQL, and gain remote code execution\u2014all with admin privileges. \n \nFind details here: https://thehackernews.com/2024/10/zero-day-alert-three-critical-ivanti.html", "url": "https://t.me/thehackernews/5704", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2024-10-08T19:22:52.354Z", "date_only": false, "value": "2024-10-08T19:22:52.354674Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-9381", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-10-08T19:22:52.354Z", "date_only": false, "value": "2024-10-08T19:22:52.354674Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9381", "record": "FKIE_CVE-2024-9381", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2024-10-08T19:23:27.864Z", "date_only": false, "value": "2024-10-08T19:23:27.864Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-10-08T19:23:27.864Z", "date_only": false, "value": "2024-10-08T19:23:27.864Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2024-9381", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-10-08T20:23:48Z", "date_only": false, "value": "2024-10-08T20:23:48.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cvedetector/7374", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "ef93af14-a21a-4733-802c-c3f04c6c9ee2", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-9381 - Ivanti CSA Path Traversal vulnerability\", \n  \"Content\": \"CVE ID : CVE-2024-9381 \nPublished : Oct. 8, 2024, 5:15 p.m. | 40\u00a0minutes ago \nDescription : Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. \nSeverity: 7.2 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "url": "https://t.me/cvedetector/7374"}, {"timestamp": "2024-10-08T22:00:00Z", "date_only": false, "value": "2024-10-08T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-3120", "record": "WID-SEC-W-2024-3120", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2024-10-08T22:00:00Z", "date_only": false, "value": "2024-10-08T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-3120", "record": "WID-SEC-W-2024-3120", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-10-08T22:00:00Z", "date_only": false, "value": "2024-10-08T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-3120", "record": "WID-SEC-W-2024-3120", "field": "vulnerabilities.2.release_date", "linked_record": true, "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2024-10-08T22:00:00Z", "date_only": false, "value": "2024-10-08T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-3120", "record": "WID-SEC-W-2024-3120", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2024-10-09T00:00:00Z", "date_only": false, "value": "2024-10-09T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0851", "record": "CERTFR-2024-AVI-0851", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2024-10-09T00:00:00Z", "date_only": false, "value": "2024-10-09T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0851", "record": "CERTFR-2024-AVI-0851", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-10-09T00:00:00Z", "date_only": false, "value": "2024-10-09T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2024-AVI-0851", "record": "CERTFR-2024-AVI-0851", "field": "revisions.0.revision_date", "linked_record": true}, {"timestamp": "2024-10-09T09:41:15.710Z", "date_only": false, "value": "2024-10-09T09:41:15.710+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-3120", "record": "WID-SEC-W-2024-3120", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2024-10-09T09:49:35.398Z", "date_only": false, "value": "2024-10-09T09:49:35.398654Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2024-0399", "record": "NCSC-2024-0399", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2024-10-09T09:49:35.398Z", "date_only": false, "value": "2024-10-09T09:49:35.398654Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2024-0399", "record": "NCSC-2024-0399", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2024-10-09T09:49:35.398Z", "date_only": false, "value": "2024-10-09T09:49:35.398654Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2024-0399", "record": "NCSC-2024-0399", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2024-10-10T08:32:47.057Z", "date_only": false, "value": "2024-10-10T08:32:47.057103Z", "kind": "sighting", "label": "Seen", "source": "https://vulnerability.circl.lu/bundle/4828357e-5b9d-45d5-a952-da459107ce93", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "49416c7a-aa7b-4812-8fa9-7b1e8caedb9a", "url": "https://vulnerability.circl.lu/bundle/4828357e-5b9d-45d5-a952-da459107ce93"}, {"timestamp": "2024-10-30T09:07:43Z", "date_only": false, "value": "2024-10-30T09:07:43.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/dbab702b-7260-475a-a9eb-490fbc6def7f", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "3c97b816-39e3-41fb-bfd5-f9fdb3f45361"}, {"timestamp": "2025-02-08T23:20:33Z", "date_only": false, "value": "2025-02-08T23:20:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/3887", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "4df2020e-f5d7-4eb0-b9c7-cd6a19ecbb8c", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-9379\n\ud83c\udfe2 Vendor: Ivanti\n\ud83d\udda5\ufe0f Product: Cloud Services Appliance (CSA)\n\ud83d\udd39 Description: Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.\n\ud83d\udccf Published: 2024-10-08T00:00:00Z\n\ud83d\udd17 References:\n1. https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\n2. https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381?language=en_US\n3. https://www.cisa.gov/sites/default/files/2025-01/aa25-022a-threat-actors-chained-vulnerabilities-in-ivanti-cloud-service-applications.pdf\n4. https://www.fortiguard.com/outbreak-alert/ivanti-csa-zero-day-attack", "url": "https://t.me/DarkWebInformer_CVEAlerts/3887"}, {"timestamp": "2026-06-17T08:24:27.430Z", "date_only": false, "value": "2026-06-17T08:24:27.430", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-9381", "record": "FKIE_CVE-2024-9381", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-08T21:53:15.372Z", "anchors": {"origin": {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": {"timestamp": "2024-10-08T18:43:40Z", "date_only": false, "value": "2024-10-08T18:43:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/5704", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "d695c946-5bc4-4dba-aabf-01d6b714e1b5", "content": "\u26a0\ufe0f WARNING: Ivanti\u2019s CSA is under attack! Three new zero-day vulnerabilities are being actively exploited in the wild. \n \nThese flaws, CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, allow attackers to bypass restrictions, execute arbitrary SQL, and gain remote code execution\u2014all with admin privileges. \n \nFind details here: https://thehackernews.com/2024/10/zero-day-alert-three-critical-ivanti.html", "url": "https://t.me/thehackernews/5704", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 8292.908, "hours": 2.3035855555555553, "days": 0.09598273148148148, "min_seconds": 8292.908, "max_seconds": 8292.908, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-10-08T18:43:40Z", "date_only": false, "value": "2024-10-08T18:43:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/5704", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "d695c946-5bc4-4dba-aabf-01d6b714e1b5", "content": "\u26a0\ufe0f WARNING: Ivanti\u2019s CSA is under attack! Three new zero-day vulnerabilities are being actively exploited in the wild. \n \nThese flaws, CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, allow attackers to bypass restrictions, execute arbitrary SQL, and gain remote code execution\u2014all with admin privileges. \n \nFind details here: https://thehackernews.com/2024/10/zero-day-alert-three-critical-ivanti.html", "url": "https://t.me/thehackernews/5704", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit": {"available": true, "seconds": 8292.908, "hours": 2.3035855555555553, "days": 0.09598273148148148, "min_seconds": 8292.908, "max_seconds": 8292.908, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2024-10-08T18:43:40Z", "date_only": false, "value": "2024-10-08T18:43:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/5704", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "d695c946-5bc4-4dba-aabf-01d6b714e1b5", "content": "\u26a0\ufe0f WARNING: Ivanti\u2019s CSA is under attack! Three new zero-day vulnerabilities are being actively exploited in the wild. \n \nThese flaws, CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, allow attackers to bypass restrictions, execute arbitrary SQL, and gain remote code execution\u2014all with admin privileges. \n \nFind details here: https://thehackernews.com/2024/10/zero-day-alert-three-critical-ivanti.html", "url": "https://t.me/thehackernews/5704", "metric_role": "exploitation", "metric_basis": "sighting_report"}}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 65770068.280297, "hours": 18269.463411193614, "days": 761.2276421330672, "min_seconds": 65770068.280297, "max_seconds": 65770068.280297, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-10-08T16:25:27.092Z", "date_only": false, "value": "2024-10-08T16:25:27.092Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2024-9381", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-08T21:53:15.372Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 65761775.372297, "hours": 18267.159825638053, "days": 761.1316594015856, "min_seconds": 65761775.372297, "max_seconds": 65761775.372297, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2024-10-08T18:43:40Z", "date_only": false, "value": "2024-10-08T18:43:40.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/5704", "record": "CVE-2024-9381", "field": "creation_timestamp", "uuid": "d695c946-5bc4-4dba-aabf-01d6b714e1b5", "content": "\u26a0\ufe0f WARNING: Ivanti\u2019s CSA is under attack! Three new zero-day vulnerabilities are being actively exploited in the wild. \n \nThese flaws, CVE-2024-9379, CVE-2024-9380, and CVE-2024-9381, allow attackers to bypass restrictions, execute arbitrary SQL, and gain remote code execution\u2014all with admin privileges. \n \nFind details here: https://thehackernews.com/2024/10/zero-day-alert-three-critical-ivanti.html", "url": "https://t.me/thehackernews/5704", "metric_role": "exploitation", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-08T21:53:15.372Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}