Veille CVE
CVE-2024-21887
9.1 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Ajoutée le 10/01/2024 · Échéance de correction (agences US) : 22/01/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.1 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.0 | 9.1 Critique | support@hackerone.com | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US Vendor Advisory
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887 US Government Resource