Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-21893

high · 8.2Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2024-01-31Remediation due 2024-02-02

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

8.2
CVSS
100.0%
EPSS (exploit prob.)
100th
EPSS percentile
2024-01-31
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses

CWE-918

Affected products

VendorProductAffected versions
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.0
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1
ivanticonnect_secure9.1

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-21893