high8.2Known exploited
CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-01-31. Federal due date: 2024-02-02.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | Connect Secure | Versions 9.0, 9.1, 21.9, 21.12, 22.1, 22.2 |
| Ivanti | Policy Secure | Versions 9.0, 9.1, 22.1, 22.2, 22.3, 22.4 |
| Ivanti | Neurons For Zero-Trust Access | All versions Versions 22.2, 22.3, 22.4, 22.5, 22.6 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
- https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893