CVE-2024-21893—Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

漏洞名称

Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

描述

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.

已知用于勒索软件活动吗？

勒索软件状态：

KNOWN

采集行动

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

其他说明

• https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
• https://nvd.nist.gov/vuln/detail/CVE-2024-21893

相关新闻文章

• Over 400 IPs Exploiting Multiple SSRF Vulnerabilities in Coordinated Cyber AttackMarch 12, 2025
• Ivanti fixes maximum severity RCE bug in Endpoint Management softwareSeptember 10, 2024
• Ivanti warns of critical vTM auth bypass with public exploitAugust 13, 2024
• Exploit Attempts Recorded Against New MOVEit Transfer Vulnerability - Patch ASAP!June 26, 2024
• Chemical facilities warned of possible data theft in CISA CSAT breachJune 24, 2024

相关 CWE

• CWE-918