CVE-2024-21893

HIGHCISA KEV

8.2

Beschreibung

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

CVE Details

CVSS v3.1 Bewertung8.2

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht1/31/2024

Zuletzt geandert10/30/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerIvanti

ProduktConnect Secure, Policy Secure, and Neurons

SchwachstellennameIvanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

KEV Aufnahmedatum2024-01-31

Behebungsfrist2024-02-02

Ransomware-NutzungKnown

Betroffene Produkte

ivanti:connect_secureivanti:neurons_for_zero-trust_accessivanti:policy_secure

Schwachen (CWE)

CWE-918CWE-918

Referenzen

https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US(support@hackerone.com)

https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.