CVE-2024-21887

Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

Connect Secure

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

12. Jan 2024

Ausgewertete Quellen

• Hersteller
  https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
• Hinweis
  http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887
• CISA
  Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
• NVD
  CVE-2024-21887