Skip to content
OpenAdvisories
Critical 2 exploited CVEs WID-SEC-2024-0059 2 CVEs

Ivanti Connect Secure: Mehrere Schwachstellen

Published Jan 10, 2024 · Updated Jan 10, 2024 · de-DE

Vendor: ivanti Product: Connect Secure Product: Connect Secure 22.x Product: Connect Secure 9.x Product: Policy Secure

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Ivanti Connect Secure und Ivanti Policy Secure ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder um beliebigen Code auszuführen.

Product

Connect Secure bietet TLS- und mobile VPN-Lösungen.
Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung.

Vulnerabilities 2

  • Critical 9.1
    CVE-2024-21887 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,…

    ivanti ICS IPS Network devices
    KEV Jan 10, 2024
  • High 8.2
    CVE-2023-46805 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a r…

    ivanti IPS ICS Network devices
    KEV Jan 10, 2024

Revision history

  1. #1

    Initiale Fassung

References

  • Ivanti security advisory vom 2024-01-10
    https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US