CVE-2024-21893 (GCVE-0-2024-21893)
Vulnerability from cvelistv5 – Published: 2024-01-31 17:51 – Updated: 2026-08-04 03:55Summary
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
Severity
8.2 (High)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-01-31 00:00 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://forums.ivanti.com/s/article/CVE-2024-2188… | |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
19 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Ivanti | ICS |
Affected:
9.1R18 , ≤ 9.1R18
(semver)
Affected: 22.6R2 , ≤ 22.6R2 (semver) |
guessed | |
| Ivanti | IPS |
Affected:
9.1R18 , ≤ 9.1R18
(semver)
Affected: 22.6R1 , ≤ 22.6R1 (semver) |
guessed | |
| ivanti | connect_secure |
Affected:
9.0
cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
22.6
cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.3
cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.6
cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.5
cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.4
cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
22.1
cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
22.2
cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
9.1
cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
21.9
cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
21.12
cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.2
cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
22.1
cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
9.1
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
22.4
cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:* |
||
| ivanti | connect_secure |
Affected:
22.3
cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:* |
||
| ivanti | policy_secure |
Affected:
9.0
cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:* |
CISA
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: b727bf85-1e7b-4f68-ac03-39d353b9c051
Exploited: Yes
Timestamps
First Seen: 2024-01-31
Asserted: 2024-01-31
Scope
Notes: KEV entry: Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | Affected: Ivanti / Connect Secure, Policy Secure, and Neurons | Description: Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication. | Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. | Due date: 2024-02-02 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893
Evidence
Type: Vendor Report
Signal: Successful Exploitation
Confidence: 80%
Source: cisa-kev
Details
| Cwes | CWE-918 |
|---|---|
| Feed | CISA Known Exploited Vulnerabilities Catalog |
| Product | Connect Secure, Policy Secure, and Neurons |
| Due Date | 2024-02-02 |
| Date Added | 2024-01-31 |
| Vendorproject | Ivanti |
| Vulnerabilityname | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability |
| Knownransomwarecampaignuse | Known |
References
Created: 2026-02-02 13:24 UTC
| Updated: 2026-02-06 07:53 UTC
Shadowserver
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: a5156856-c2ae-428b-97ec-a1323da2db7d
Exploited: Yes
Characteristics
Severity:
82.0
Timestamps
First Seen: 2024-02-03
Asserted: 2024-02-03
Last Seen: 2026-09-06
Scope
Asset Exposure: ['internet-facing']
Notes: Affected: Ivanti / Ivanti Connect Secure, Policy Secure and Ivanti Neurons for ZTA | Class: vpn | Severity: High (CVSS 8.2) | IoT: no | In CISA KEV: yes | Honeypot connections on 2026-09-06: 19
Evidence
Type: Honeypot
Signal: In The Wild Attempts
Confidence: 70%
Source: shadowserver
Details
| 1D | 3 |
|---|---|
| Iot | no |
| Feed | Shadowserver Foundation honeypot/exploited-vulnerabilities |
| Type | http-scan |
| Class | vpn |
| 7D Avg | 1 |
| Vendor | Ivanti |
| 30D Avg | 0 |
| 90D Avg | 1 |
| Product | Ivanti Connect Secure, Policy Secure and Ivanti Neurons for ZTA |
| Cisa Kev | yes |
| Connections | 19 |
| Observation Date | 2026-09-06 |
| Vulnerability Class | CVSS |
| Vulnerability Score | 8.2 |
| Vulnerability Severity | High |
References
Created: 2026-07-01 05:54 UTC
| Updated: 2026-09-08 01:01 UTC
Previdian
Known Exploited Vulnerability - GCVE BCP-07 Compliant
KEV entry ID: 9f401d0b-c303-4a24-a48e-8835987f240f
Exploited: Yes
Timestamps
First Seen: 2024-01-31
Asserted: 2024-01-31
Scope
Notes: KEVIntel entry: A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and... | Affected: Ivanti / ICS, IPS | CVSS: 8.2 (HIGH) | Used in malware: yes | Not yet in CISA KEV: False
Evidence
Type: Public Report
Signal: Confirmed Compromise
Confidence: 70%
Source: kevintel
Details
| Feed | KEVIntel (kevintel.com) |
|---|---|
| Title | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and... |
| Vendor | Ivanti |
| Product | ICS, IPS |
| Added Date | 2024-01-31T00:00:00.000Z |
| Cvss Score | 8.2 |
| Epss Score | None |
| Cvss Severity | HIGH |
| Epss Percentile | None |
| Used In Malware | yes |
| Ahead Of Cisa Kev | None |
| Not Yet In Cisa Kev | False |
References
Created: 2026-06-23 11:14 UTC
| Updated: 2026-06-23 11:14 UTC
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21893",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-31T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-01-31",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T03:55:53.926Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-31T00:00:00.000Z",
"value": "CVE-2024-21893 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:33.414Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ICS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R2",
"status": "affected",
"version": "22.6R2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IPS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R1",
"status": "affected",
"version": "22.6R1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T17:51:35.095Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-21893",
"datePublished": "2024-01-31T17:51:35.095Z",
"dateReserved": "2024-01-03T01:04:06.539Z",
"dateUpdated": "2026-08-04T03:55:53.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"cisa_known_exploited": {
"cveID": "CVE-2024-21893",
"cwes": [
"CWE-918"
],
"dateAdded": "2024-01-31",
"dueDate": "2024-02-02",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893",
"product": "Connect Secure, Policy Secure, and Neurons",
"requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"shortDescription": "Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.",
"vendorProject": "Ivanti",
"vulnerabilityName": "Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability"
},
"epss": {
"cve": "CVE-2024-21893",
"date": "2026-09-20",
"epss": "0.99999",
"percentile": "0.99999"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "ICS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R2",
"status": "affected",
"version": "22.6R2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IPS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R1",
"status": "affected",
"version": "22.6R1",
"versionType": "semver"
}
]
}
],
"source": "support@hackerone.com"
},
{
"affectedData": [
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"cisaActionDue": "2024-02-02",
"cisaExploitAdd": "2024-01-31",
"cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*",
"matchCriteriaId": "3818B543-3415-4E27-8DAD-6BA9D3D9A1A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*",
"matchCriteriaId": "D47D09A8-4AC4-4CD9-B648-5F26453E2E1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*",
"matchCriteriaId": "59331DC5-FF5F-4BB3-905E-5A4A621F86ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "6A708C3F-9050-4475-95B3-4785D3E2CB69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*",
"matchCriteriaId": "52851AAA-88FB-40BC-B41A-B821F6BA9F79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*",
"matchCriteriaId": "F05DC11E-7C41-450B-A2BF-603E9252BB40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*",
"matchCriteriaId": "5DA976D9-A330-475E-B8C0-09EF3E08F18D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*",
"matchCriteriaId": "59F4A6F7-A6D4-4517-A316-7C7C002A9ED3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*",
"matchCriteriaId": "702094B0-2E5C-4A16-A8B0-F0EAF78E4ECB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*",
"matchCriteriaId": "A369AE09-17E4-4541-A8E1-A2F4A1398EE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*",
"matchCriteriaId": "24EF2F1A-8140-4FDB-8AF4-309AFAF998E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*",
"matchCriteriaId": "4755BC2C-A96E-47AF-9D7C-E8D44B31F10B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*",
"matchCriteriaId": "BF6E8A0C-192B-4F51-86AA-FC2B85657632",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "4B21C181-DC49-4EBD-9932-DBB337151FF7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*",
"matchCriteriaId": "5A3A93FE-41BF-43F2-9EFC-89656182329F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*",
"matchCriteriaId": "8D5F47BA-DE6D-443D-95C3-A45F80EDC71E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*",
"matchCriteriaId": "366EF5B8-0233-49B8-806A-E54F60410ADE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.4:*:*:*:*:*:*",
"matchCriteriaId": "6F2A7F5C-1D78-4D19-B8ED-5822FDF5DA63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*",
"matchCriteriaId": "2DDDA231-2A5E-4C70-8620-535C7F9027A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*",
"matchCriteriaId": "32E0B425-A9BA-4D00-84A9-46268072D696",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r12.1:*:*:*:*:*:*",
"matchCriteriaId": "BBC724E8-195B-4CB4-AC2A-63E184AED4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*",
"matchCriteriaId": "65435A96-EF7A-439A-AA6C-CB7EAEF0A963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r13.1:*:*:*:*:*:*",
"matchCriteriaId": "3027A9CE-849E-4CAE-A1C4-170DEAF4FE86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:*:*:*:*",
"matchCriteriaId": "C132BA26-BCA0-43E6-9511-34ACFFA136A9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*",
"matchCriteriaId": "CE228FBD-5AD1-4BC6-AF63-5248E671B04F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r15.2:*:*:*:*:*:*",
"matchCriteriaId": "D7DBCD6B-B7AA-4AB0-852F-563A2EC85DB4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*",
"matchCriteriaId": "44C26423-8621-4F6D-A45B-0A6B6E873AB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r16.1:*:*:*:*:*:*",
"matchCriteriaId": "BC391EB5-C457-459C-8EAA-EA0043487C0B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*",
"matchCriteriaId": "DB6CEA16-F422-48F1-9473-3931B1BFA63F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r17.1:*:*:*:*:*:*",
"matchCriteriaId": "E238AB9F-99C1-4F0D-B442-D390065D35D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*",
"matchCriteriaId": "28FDE909-711C-41EC-8BA6-AC4DE05EA27E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r18.1:*:*:*:*:*:*",
"matchCriteriaId": "080CD832-3324-4158-A4CD-3A2E49B7BC74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r18.2:*:*:*:*:*:*",
"matchCriteriaId": "DB2B8165-E9D4-4549-B16E-A62810BDAF8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "4FEFC4B1-7350-46F9-80C1-42F5AE06142F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "DB7A6D62-6576-4713-9BF4-11068A72E8B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*",
"matchCriteriaId": "843BC1B9-50CC-4F8F-A454-A0CEC6E92290",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*",
"matchCriteriaId": "D5355372-03EA-46D7-9104-A2785C29B664",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*",
"matchCriteriaId": "3DE32A0C-8944-4F51-A286-266055CA4B2F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*",
"matchCriteriaId": "0349A0CC-A372-4E51-899E-D7BA67876F4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*",
"matchCriteriaId": "93D1A098-BD77-4A7B-9070-A764FB435981",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*",
"matchCriteriaId": "3CCC2D7B-F835-45EC-A316-2F0C5F2CF565",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*",
"matchCriteriaId": "AD812596-C77C-4129-982F-C22A25B52126",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*",
"matchCriteriaId": "9FA0B20D-3FA1-42AE-BDC5-93D8A182927C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*",
"matchCriteriaId": "BFFA0B02-7F6D-4434-B1E7-EB8520FD68A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*",
"matchCriteriaId": "DFE8FA87-9622-4D5B-99C7-D8EE230C0AA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*",
"matchCriteriaId": "16DAA769-8F0D-4C54-A8D9-9902995605B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*",
"matchCriteriaId": "B2C10C89-1DBC-4E91-BD28-D5097B589CA9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*",
"matchCriteriaId": "BD52B87C-4BED-44AE-A959-A316DAF895EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*",
"matchCriteriaId": "8CA29F12-36DE-4FBF-9EE7-7CE4B75AFA61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "80C56782-273A-4151-BE81-13FEEFE46A6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.1:r6:*:*:*:*:*:*",
"matchCriteriaId": "6564FE9E-7D96-4226-8378-DAC25525CDD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*",
"matchCriteriaId": "361FAA47-52FF-4B36-96B0-9C178A4E031B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "BCBF6DD0-2826-4E61-8FB6-DB489EBF8981",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "415219D0-2D9A-4617-ABB7-6FF918421BEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "E9F55E7B-7B38-4AEC-A015-D8CB9DE5E72C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.4:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "D3DF17AC-EC26-4B76-8989-B7880C9EF73E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*",
"matchCriteriaId": "6C383863-1E90-4B72-A500-4326782BC92F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.6:r1:*:*:*:*:*:*",
"matchCriteriaId": "AB9A5868-34FB-446E-817F-6701CC5DE923",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.6:r2:*:*:*:*:*:*",
"matchCriteriaId": "5456F61D-1FD1-4DA6-AFA3-4073889AD22A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.6:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "EA574551-14BF-45E1-AC2A-2FB5B265640E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*",
"matchCriteriaId": "AFE8DB4A-9891-4647-82E2-EB5D377CAD25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*",
"matchCriteriaId": "26B25B34-7BD0-471B-A396-45CE5420E963",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*",
"matchCriteriaId": "AA514C05-2834-4C7B-B022-02B41C9AAD6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "0929C645-DACB-4341-9032-7C79FFC8BCF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*",
"matchCriteriaId": "0D36CB5A-8389-4F2F-882A-4E8F30028799",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*",
"matchCriteriaId": "517DA74B-9D69-45E1-A707-A08A305A507C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*",
"matchCriteriaId": "F72C00C7-017C-4C25-99B0-D7D42D969E92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*",
"matchCriteriaId": "6418A649-3A63-40CC-BD7C-309B3B0B2595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "A07B66E0-A679-4912-8CB1-CD134713EDC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*",
"matchCriteriaId": "BF767F07-2E9F-4099-829D-2F70E85D8A35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*",
"matchCriteriaId": "B994E22B-8FA5-4510-82F6-7820BDA7C307",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*",
"matchCriteriaId": "FE5C4ABC-2BEB-4741-95B3-303903369818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*",
"matchCriteriaId": "D50C5526-F791-4C76-B5C0-DA2E1281C9E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r13.1:*:*:*:*:*:*",
"matchCriteriaId": "2CB8240E-7683-4C39-9654-4F8D1F682288",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*",
"matchCriteriaId": "7A53C031-E7A5-47B6-BA4A-DD28432E743F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*",
"matchCriteriaId": "4BEE355B-1C2D-4BEB-8922-EAEAA5A1FAE8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*",
"matchCriteriaId": "B90687F3-A5C1-4706-AD66-D78EE512E4C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*",
"matchCriteriaId": "D10A3F2D-6A62-4A48-93FB-274527C821D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*",
"matchCriteriaId": "811C7E7E-89AB-47DF-BACD-ED478DF756BC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r18.1:*:*:*:*:*:*",
"matchCriteriaId": "98FC67F0-3EEF-4C69-BB94-A15B1FE4D8F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r18.2:*:*:*:*:*:*",
"matchCriteriaId": "77AA3823-7B01-423E-BE8E-797AEB567B8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*",
"matchCriteriaId": "6D37A6E4-D58E-444D-AF6A-15461F38E81A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*",
"matchCriteriaId": "FC2B9DA0-E32B-4125-9986-F0D3814C66E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r3.1:*:*:*:*:*:*",
"matchCriteriaId": "38A0D7CF-7D55-4933-AE8C-36006D6779E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*",
"matchCriteriaId": "C9A5BA3E-D6B3-453D-8DDF-FF16859FD0F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r4.1:*:*:*:*:*:*",
"matchCriteriaId": "BAFDA618-D15D-401D-AC68-0020259FEC57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r4.2:*:*:*:*:*:*",
"matchCriteriaId": "D55AB5F0-132F-4C40-BF4F-684E139B774B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r4.3:*:*:*:*:*:*",
"matchCriteriaId": "26AEB02E-D2D0-4D7A-BB00-9E5112696B17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*",
"matchCriteriaId": "6BE937D2-8BEE-4E64-8738-F550EAD00F50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*",
"matchCriteriaId": "9C753520-1BC6-4980-AFC9-4C2FDDF2FD18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*",
"matchCriteriaId": "AC3863BC-3B9A-402B-A74A-149CDF717EC6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*",
"matchCriteriaId": "E3C09D51-FDA0-4D07-87D8-F527C8CBDAFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r8.1:*:*:*:*:*:*",
"matchCriteriaId": "CCE2E1C0-680F-4EFF-ACE6-A1DAFA209D24",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r8.2:*:*:*:*:*:*",
"matchCriteriaId": "7ED1686B-2D80-4ECF-9F7A-AEA989E17C84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*",
"matchCriteriaId": "092DA2A3-5CEF-433F-8E5B-4850E4095CC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*",
"matchCriteriaId": "A385F38B-0B03-4B69-B7A1-952F5BAE727C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.1:r6:*:*:*:*:*:*",
"matchCriteriaId": "925DCCBA-9382-4A39-84B8-4DEAFD2BC802",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "34C118FB-7AE0-466C-822A-348A2F6016AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.2:r3:*:*:*:*:*:*",
"matchCriteriaId": "1536DB45-9A42-4549-A10E-FDBB6693DF17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "51FF66C9-9415-4EAD-8F19-D5E067336885",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.3:r3:*:*:*:*:*:*",
"matchCriteriaId": "8BBC1E81-0A2A-4166-BFA6-2B866B4F8AE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "D73729EB-C679-4CED-9F36-212B0581EC22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.4:r2:*:*:*:*:*:*",
"matchCriteriaId": "14B481E8-D887-408F-B892-D2939CD037AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.4:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "3EB8380F-D229-4AF0-B27C-47760F843E48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*",
"matchCriteriaId": "CB4B1ED6-38AD-44F8-9B77-2D6924E8A20E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*",
"matchCriteriaId": "56C7542D-3520-4E4D-936C-5295068C4CD7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0E4387B4-BC5C-41DE-92DA-84866A649AD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*",
"matchCriteriaId": "24514B40-540E-45D7-90DC-BCC1D9D7E92C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r4:*:*:*:*:*:*",
"matchCriteriaId": "BFD510E9-12DC-4942-BAA0-6405CBD905EF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r5:*:*:*:*:*:*",
"matchCriteriaId": "EA11BB6D-36C7-438B-A5A7-71C3CB2E5EC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r1:*:*:*:*:*:*",
"matchCriteriaId": "7B01001B-FA11-4297-AB81-12A00B97C820",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r4:*:*:*:*:*:*",
"matchCriteriaId": "9F28E6B1-44AB-4635-8939-5B0A44BED1E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r1:*:*:*:*:*:*",
"matchCriteriaId": "3E9D957B-49F9-492D-A66A-0D25BA27AD35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r3:*:*:*:*:*:*",
"matchCriteriaId": "D1AB497E-E403-4DEE-A83D-CB2E119E5E96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1:*:*:*:*:*:*",
"matchCriteriaId": "CA6B3322-9AFB-44B5-B571-995AB606FD01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "47CB7C12-D642-4015-842C-37241F87DB86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1:*:*:*:*:*:*",
"matchCriteriaId": "58E49DF1-F66A-4F52-87FA-A50DFD735ECB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "62A0393A-C1C6-4708-BC41-5A5B8FB765FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication."
},
{
"lang": "es",
"value": "Una vulnerabilidad de server-side request forgery en el componente SAML de Ivanti Connect Secure (9.x, 22.x) e Ivanti Policy Secure (9.x, 22.x) e Ivanti Neurons for ZTA permite a un atacante acceder a ciertos recursos restringidos sin autenticaci\u00f3n."
}
],
"id": "CVE-2024-21893",
"lastModified": "2026-08-04T05:16:30.353",
"metrics": {
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "support@hackerone.com",
"type": "Secondary"
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-21893",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-01-31T00:00:00+00:00",
"version": "2.0.3"
}
}
]
},
"published": "2024-01-31T18:15:47.437",
"references": [
{
"source": "support@hackerone.com",
"tags": [
"Vendor Advisory"
],
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893"
}
],
"sourceIdentifier": "support@hackerone.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-918"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2026-03-27T10:15:40+00:00",
"cve": "CVE-2024-21893",
"id": "CVE-2024-21893",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2024-21893",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-21893.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:33.414Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.6:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.6:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.5:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.5"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.2:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.9:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.9"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:21.12:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "21.12"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.2:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.2"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:22.1:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.1"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.4:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.4"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:connect_secure:22.3:r1:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "connect_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "22.3"
}
]
},
{
"cpes": [
"cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "policy_secure",
"vendor": "ivanti",
"versions": [
{
"status": "affected",
"version": "9.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-21893",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-01T05:00:07.654275Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2024-01-31",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-01T19:17:35.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-01-31T00:00:00.000Z",
"value": "CVE-2024-21893 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ICS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R2",
"status": "affected",
"version": "22.6R2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "IPS",
"vendor": "Ivanti",
"versions": [
{
"lessThanOrEqual": "9.1R18",
"status": "affected",
"version": "9.1R18",
"versionType": "semver"
},
{
"lessThanOrEqual": "22.6R1",
"status": "affected",
"version": "22.6R1",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-01-31T17:51:35.095Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-21893",
"datePublished": "2024-01-31T17:51:35.095Z",
"dateReserved": "2024-01-03T01:04:06.539Z",
"dateUpdated": "2026-08-04T03:55:53.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…