Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-21887

critical · 9.1Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-01-10Remediation due 2024-01-22

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

9.1
CVSS
100.0%
EPSS (exploit prob.)
100th
EPSS percentile
2024-01-12
Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

VendorProductAffected versions
ivanticonnect_secure9.0
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure22.1
ivanticonnect_secure22.1
ivanticonnect_secure22.2
ivanticonnect_secure22.2
ivanticonnect_secure22.3
ivanticonnect_secure22.4
ivanticonnect_secure22.4

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-21887