CVE-2024-21893

HIGH8.2SSRF

CISA KEVRansomwarePublic PoCHigh EPSS

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

CVSS breakdown

CVSS 3.0

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected products

Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.0 – 9.0
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure9.1 – 9.1
Ivanti / Connect Secure21.9 – 21.9
Ivanti / Connect Secure21.12 – 21.12
Ivanti / Connect Secure22.1 – 22.1
Ivanti / Connect Secure22.1 – 22.1
Ivanti / Connect Secure22.2 – 22.2
Ivanti / Connect Secure22.2 – 22.2
Ivanti / Connect Secure22.3 – 22.3
Ivanti / Connect Secure22.4 – 22.4
Ivanti / Connect Secure22.4 – 22.4
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure22.6 – 22.6
Ivanti / Connect Secure22.6 – 22.6
Ivanti / ICS22.6R2 – 22.6R2
Ivanti / ICS9.1R18 – 9.1R18
Ivanti / IPS9.1R18 – 9.1R18
Ivanti / IPS22.6R1 – 22.6R1
Ivanti / neurons_for_zero-trust_access
Ivanti / neurons_for_zero-trust_access22.2 – 22.2
Ivanti / neurons_for_zero-trust_access22.2 – 22.2
Ivanti / neurons_for_zero-trust_access22.2 – 22.2
Ivanti / neurons_for_zero-trust_access22.3 – 22.3
Ivanti / neurons_for_zero-trust_access22.3 – 22.3
Ivanti / neurons_for_zero-trust_access22.4 – 22.4
Ivanti / neurons_for_zero-trust_access22.5 – 22.5
Ivanti / neurons_for_zero-trust_access22.4 – 22.4
Ivanti / neurons_for_zero-trust_access22.5 – 22.5
Ivanti / neurons_for_zero-trust_access22.6 – 22.6
Ivanti / neurons_for_zero-trust_access22.6 – 22.6
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure22.1 – 22.1
Ivanti / Policy Secure22.1 – 22.1
Ivanti / Policy Secure22.2 – 22.2
Ivanti / Policy Secure22.2 – 22.2
Ivanti / Policy Secure22.3 – 22.3
Ivanti / Policy Secure22.3 – 22.3
Ivanti / Policy Secure22.4 – 22.4
Ivanti / Policy Secure22.4 – 22.4
Ivanti / Policy Secure22.4 – 22.4
Ivanti / Policy Secure22.5 – 22.5
Ivanti / Policy Secure22.6 – 22.6
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.0 – 9.0
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1
Ivanti / Policy Secure9.1 – 9.1

Exploits & proofs of concept

nucleiIvanti SAML - Server Side Request Forgery (SSRF)by DhiyaneshDk

References

MISChttps://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

Updated 22m ago · 8 sources