Ivanti Connect Secure: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 8.2
  CVE-2024-21893 Exploited · Ransomware Public exploit Scanner template EPSS 100%

  A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Polic…

  ivanti IPS ICS Network devices
  Jan 31, 2024

  KEV Jan 31, 2024
• High 8.8
  CVE-2024-21888 EPSS 85%

  A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.…

  ivanti ICS IPS Network devices
  Jan 31, 2024

Revision history

1. 2024-02-01 #2

   Exploit-Hinweis aufgenommen

2. 2024-01-31 #1

   Initiale Fassung

References

• Ivanti Security Advisory vom 2024-01-31
  https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
• CISA Known Exploited Vulnerabilities vom 2024-01-31
  https://www.cisa.gov/news-events/alerts/2024/01/31/cisa-adds-one-known-exploited-vulnerability-catalog-0
• Github Security Advisory vom 2024-01-31
  https://github.com/advisories/GHSA-5rr9-mqhj-7cr2