Vulnerability Details CVE-2024-21887
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.944
EPSS Ranking 100.0%
CVSS Severity
CVSS v3 Score 9.1
Proposed Action
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
Ransomware Campaign
Unknown
References
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
Products affected by CVE-2024-21887
-
cpe:2.3:a:ivanti:connect_secure:22.1
-
cpe:2.3:a:ivanti:connect_secure:22.2
-
cpe:2.3:a:ivanti:connect_secure:22.3
-
cpe:2.3:a:ivanti:connect_secure:22.4
-
cpe:2.3:a:ivanti:connect_secure:22.5
-
cpe:2.3:a:ivanti:connect_secure:22.6
-
cpe:2.3:a:ivanti:connect_secure:9.0
-
cpe:2.3:a:ivanti:connect_secure:9.1
-
cpe:2.3:a:ivanti:policy_secure:22.1
-
cpe:2.3:a:ivanti:policy_secure:22.2
-
cpe:2.3:a:ivanti:policy_secure:22.3
-
cpe:2.3:a:ivanti:policy_secure:22.4
-
cpe:2.3:a:ivanti:policy_secure:22.5
-
cpe:2.3:a:ivanti:policy_secure:22.6
-
cpe:2.3:a:ivanti:policy_secure:9.0
-
cpe:2.3:a:ivanti:policy_secure:9.1