Vulnerability Details CVE-2024-21894
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code
Exploit prediction scoring system (EPSS) score
EPSS Score 0.081
EPSS Ranking 91.7%
CVSS Severity
CVSS v3 Score 8.2
References
- https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
- https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
Products affected by CVE-2024-21894
-
cpe:2.3:a:ivanti:connect_secure:22.1
-
cpe:2.3:a:ivanti:connect_secure:22.2
-
cpe:2.3:a:ivanti:connect_secure:22.3
-
cpe:2.3:a:ivanti:connect_secure:22.4
-
cpe:2.3:a:ivanti:connect_secure:22.5
-
cpe:2.3:a:ivanti:connect_secure:22.6
-
cpe:2.3:a:ivanti:connect_secure:9.1
-
cpe:2.3:a:ivanti:policy_secure:22.1
-
cpe:2.3:a:ivanti:policy_secure:22.2
-
cpe:2.3:a:ivanti:policy_secure:22.3
-
cpe:2.3:a:ivanti:policy_secure:22.4
-
cpe:2.3:a:ivanti:policy_secure:22.5
-
cpe:2.3:a:ivanti:policy_secure:22.6
-
cpe:2.3:a:ivanti:policy_secure:9.0
-
cpe:2.3:a:ivanti:policy_secure:9.1