Read the docs
TI-2024-07014 Aliases CVE-2024-7569GHSA-rj6p-94v3-4ccp

Insecure storage of sensitive information in Ivanti ITSM

Priority MEDIUM 46CWE-215Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-922.

Summary

An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01737 77th percentileScored 2026-11-07
Fix Fixed ITSM (Ivanti): 2023.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IvantiITSM2023.4 and later2023.4.0Patch availableCNA
  • ITSM VendorIvanti Affected 2023.4 and later Fixed in 2023.4.0 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:ivanti:neurons_for_itsm:2023.2:*:*:*:*:*:*:*2023.2VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_itsm:2023.3:*:*:*:*:*:*:*2023.3VulnerableIvanti
cpe:2.3:a:ivanti:neurons_for_itsm:2023.4:*:*:*:*:*:*:*2023.4VulnerableIvanti
  • cpe:2.3:a:ivanti:neurons_for_itsm:2023.2:*:*:*:*:*:*:* Versions 2023.2 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_itsm:2023.3:*:*:*:*:*:*:* Versions 2023.3 Vulnerable ·Ivanti
  • cpe:2.3:a:ivanti:neurons_for_itsm:2023.4:*:*:*:*:*:*:* Versions 2023.4 Vulnerable ·Ivanti

Remediation

  • Fix · CNA ITSM (Ivanti) Fixed in 2023.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7569
  2. 2026-10-03 Alias added: GHSA-rj6p-94v3-4ccp

References

Patch 1

  • TI-2026-10894 Deserialization of untrusted data in Ivanti Neurons for ITSM CVSS 3.1CRITICAL 9.8
  • TI-2026-10893 Deserialization of untrusted data in Ivanti Neurons for ITSM CVSS 3.1CRITICAL 9.8
  • TI-2025-16354 Authentication bypass in Ivanti Neurons for ITSM CVSS 3.1CRITICAL 9.8
  • TI-2026-10832 Deserialization of untrusted data in Ivanti Neurons for ITSM CVSS 3.1CRITICAL 9.9
  • TI-2023-25281 Unrestricted file upload in Ivanti ITSM CVSS 3.1CRITICAL 9.9
  • TI-2026-10830 Missing authorization in Ivanti Neurons for ITSM CVSS 3.1CRITICAL 9.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences