CVE-2024-5671 - Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager

Back Back to CVE browser

CRITICAL

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager

Published Jun 14, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.93%

Description

Insecure Deserialization in some workflows of the IPS Manager allows unauthenticated remote attackers to perform arbitrary code execution and access to the vulnerable Trellix IPS Manager.

Affected products

Vendor Trellix Product Intrusion Prevention System (IPS) Manager Default
unaffected
- Version
  Prior to 11.1.x
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trellix

Intrusion Prevention System (IPS) Manager

unaffected

Version	Status	Constraints
Prior to 11.1.x	affected	-

Vendor Trellix Product Intrusion Prevention System Manager Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <11.1.x

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trellix

Intrusion Prevention System Manager

n/a

Version	Status	Constraints
0	affected	<11.1.x

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-46844		Advisory
https://thrive.trellix.com/s/article/000013623

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trellix

Published Jun 14, 2024

Updated Aug 1, 2024

Reserved Jun 6, 2024

Link CVE-2024-5671

CISA Vulnrichment

Updated Jun 14, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2024-5671

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-5671

ENISA EUVD

Assigner trellix

Published Jun 14, 2024

Updated Aug 1, 2024

Exploited since n/a

Link EUVD-2024-46844

EUVD-2024-46844