← CVE Radar
CVE-2024-21893Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
8.2 HIGHEPSS 99.99%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.2 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| 8.2 | HIGH | 3.0hackerone (CNA) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
CISA required action
⚡ Known exploited · remediation due Feb 2, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-21893
- Status
- Analyzed
- Assigner (CNA)
- hackerone
- Published
- Jan 31, 2024
- Last modified
- 2026-08-04 05:16 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
IvantiICS2 version ranges
- 9.1R18 through 9.1R18
- 22.6R2 through 22.6R2
IvantiIPS2 version ranges
- 9.1R18 through 9.1R18
- 22.6R1 through 22.6R1