Ivanti · Connect Secure, Policy Secure, and Neurons
CVE-2024-21893
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Nedir
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CISA: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 2 Şubat 2024
Ivanti için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 13 Eki 2026 | Authentication Bypass by Spoofing | Connect Secure | Yüksek 8,6 | 87% |
| 11 Haz 2026 | OS Command Injection | Sentry | Kritik 10,0 | 99,9% |
| 7 May 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | Yüksek 7,2 | 34% |
| 8 Nis 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Kritik 9,8 | 99% |
| 9 Mar 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | Yüksek 8,6 | 88% |
| 29 Oca 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Kritik 9,8 | 99% |
| 19 May 2025 | Authentication Bypass | Endpoint Manager Mobile (EPMM) | Orta 5,3 | 99,9% |
| 19 May 2025 | Code Injection | Endpoint Manager Mobile (EPMM) | Yüksek 7,2 | 88% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.