Vulnerability Description
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Connect Secure | 9.0 |
| Ivanti | Policy Secure | 9.0 |
| Ivanti | Neurons For Zero-Trust Access | - |
Related Weaknesses (CWE)
References
- https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-IvanVendor Advisory
- https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-IvanVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-US Government Resource
FAQ
What is CVE-2024-21893?
CVE-2024-21893 is a vulnerability with a CVSS score of 8.2 (HIGH). A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access cert...
How severe is CVE-2024-21893?
CVE-2024-21893 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-21893?
Check the references section above for vendor advisories and patch information. Affected products include: Ivanti Connect Secure, Ivanti Policy Secure, Ivanti Neurons For Zero-Trust Access.