CVE-2024-21893
Last modified
CVE-2024-21893 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.. CISA has confirmed active exploitation in the wild. EPSS estimates a 100.00% chance of exploitation in the next 30 days.
Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
100.0th percentile
Probability of exploitation in the next 30 days. Learn more
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Ivanti | Connect Secure | 9.0 | — |
| Ivanti | Connect Secure | 9.1 | R1 |
| Ivanti | Connect Secure | 21.9 | R1 |
| Ivanti | Connect Secure | 21.12 | R1 |
| Ivanti | Connect Secure | 22.1 | R1 |
| Ivanti | Connect Secure | 22.2 | — |
| Ivanti | Connect Secure | 22.3 | R1 |
| Ivanti | Connect Secure | 22.4 | R1 |
| Ivanti | Connect Secure | 22.6 | — |
| Ivanti | Policy Secure | 9.0 | — |
| Ivanti | Policy Secure | 9.1 | — |
| Ivanti | Policy Secure | 22.1 | R1 |
| Ivanti | Policy Secure | 22.2 | R1 |
| Ivanti | Policy Secure | 22.3 | R1 |
| Ivanti | Policy Secure | 22.4 | R1 |
| Ivanti | Policy Secure | 22.5 | R1 |
| Ivanti | Policy Secure | 22.6 | R1 |
| Ivanti | Neurons For Zero-Trust Access | All versions | — |
| Ivanti | Neurons For Zero-Trust Access | 22.2 | R1 |
| Ivanti | Neurons For Zero-Trust Access | 22.3 | R1 |
| Ivanti | Neurons For Zero-Trust Access | 22.4 | R1 |
| Ivanti | Neurons For Zero-Trust Access | 22.5 | R1 |
| Ivanti | Neurons For Zero-Trust Access | 22.6 | R1 |
References
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-21893?
How severe is CVE-2024-21893?
How do I fix CVE-2024-21893?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-21887A command injection vulnerability in web components of Ivant…9.1
- CVE-2024-21888A privilege escalation vulnerability in web component of Iva…8.8
- CVE-2024-2189The Social Icons Widget & Block by WPZOOM WordPress plugin b…6.1
- CVE-2024-21890The Node.js Permission Model does not clarify in the documen…6.5
- CVE-2024-21891Node.js depends on multiple built-in utility functions to no…8.8
- CVE-2024-21892On Linux, Node.js ignores certain environment variables if t…7.8
- CVE-2024-21894A heap overflow vulnerability in IPSec component of Ivanti C…9.8
- CVE-2024-21896The permission model protects itself against path traversal …9.8
- CVE-2024-21897A cross-site scripting (XSS) vulnerability has been reported…5.4
- CVE-2024-21898An OS command injection vulnerability has been reported to a…8.8
- CVE-2024-21899An improper authentication vulnerability has been reported t…9.8
- CVE-2024-21900An injection vulnerability has been reported to affect sever…6.5
Are you affected by CVE-2024-21893?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST