CVEs / CVE-2024-21893
CVE-2024-21893: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
- Known exploited in the CISA KEV catalog since 31 Jan 2024
- high 8.2 CVSS 3.1 (NVD)
- EPSS 99.9% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-21893
Summary
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti ICS | from 9.1R18, up to and including 9.1R18 | — |
| Ivanti ICS | from 22.6R2, up to and including 22.6R2 | — |
| Ivanti IPS | from 9.1R18, up to and including 9.1R18 | — |
| Ivanti IPS | from 22.6R1, up to and including 22.6R1 | — |
| ivanti connect_secure | 9.0 | — |
| ivanti connect_secure | 22.6 | — |
| ivanti policy_secure | 22.3 | — |
| ivanti policy_secure | 22.6 | — |
| ivanti policy_secure | 22.5 | — |
| ivanti policy_secure | 22.4 | — |
| ivanti connect_secure | 22.1 | — |
| ivanti connect_secure | 22.2 | — |
| ivanti connect_secure | 9.1 | — |
| ivanti connect_secure | 21.9 | — |
| ivanti connect_secure | 21.12 | — |
| ivanti policy_secure | 22.2 | — |
| ivanti policy_secure | 22.1 | — |
| ivanti policy_secure | 9.1 | — |
| ivanti connect_secure | 22.4 | — |
| ivanti connect_secure | 22.3 | — |
| ivanti policy_secure | 9.0 | — |
Exploitation
| In CISA KEV since | 31 Jan 2024 |
|---|---|
| Due date for US federal agencies | 2 Feb 2024 |
| Used in ransomware campaigns | Known |
| Required action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
Severity
| CVSS 3.1 | 8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NScored by NVD |
|---|---|
| Weakness | CWE-918 |
References
- CVE-2024-21893 on NVD
- CVE-2024-21893 in the CISA KEV catalog
- https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US (cited by CISA)
- https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.