Lucene search
HackeroneCVE-2024-21888HistoryJan 31, 2024 - 6:15 p.m.
CVE-2024-21888
2024-01-3118:15:47
hackerone
web.nvd.nist.gov
81
In Wild
40
cve-2024-21888
privilege escalation
web component
ivanti connect secure
ivanti policy secure
nvd
security vulnerability
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
9.1
Confidence
High
EPSS
0.001
Percentile
19.3%
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
Affected configurations
Node
ivanticonnect_secureMatch9.0-
ORivanticonnect_secureMatch9.0r1
ORivanticonnect_secureMatch9.0r2
ORivanticonnect_secureMatch9.0r2.1
ORivanticonnect_secureMatch9.0r3
ORivanticonnect_secureMatch9.0r3.1
ORivanticonnect_secureMatch9.0r3.2
ORivanticonnect_secureMatch9.0r3.3
ORivanticonnect_secureMatch9.0r3.5
ORivanticonnect_secureMatch9.0r4
ORivanticonnect_secureMatch9.0r4.1
ORivanticonnect_secureMatch9.0r5.0
ORivanticonnect_secureMatch9.0r6.0
ORivanticonnect_secureMatch9.1r1
ORivanticonnect_secureMatch9.1r10
ORivanticonnect_secureMatch9.1r11
ORivanticonnect_secureMatch9.1r11.3
ORivanticonnect_secureMatch9.1r11.4
ORivanticonnect_secureMatch9.1r11.5
ORivanticonnect_secureMatch9.1r12
ORivanticonnect_secureMatch9.1r12.1
ORivanticonnect_secureMatch9.1r13
ORivanticonnect_secureMatch9.1r13.1
ORivanticonnect_secureMatch9.1r14
ORivanticonnect_secureMatch9.1r15
ORivanticonnect_secureMatch9.1r15.2
ORivanticonnect_secureMatch9.1r16
ORivanticonnect_secureMatch9.1r16.1
ORivanticonnect_secureMatch9.1r17
ORivanticonnect_secureMatch9.1r17.1
ORivanticonnect_secureMatch9.1r18
ORivanticonnect_secureMatch9.1r18.1
ORivanticonnect_secureMatch9.1r18.2
ORivanticonnect_secureMatch9.1r2
ORivanticonnect_secureMatch9.1r3
ORivanticonnect_secureMatch9.1r4
ORivanticonnect_secureMatch9.1r4.1
ORivanticonnect_secureMatch9.1r4.2
ORivanticonnect_secureMatch9.1r4.3
ORivanticonnect_secureMatch9.1r5
ORivanticonnect_secureMatch9.1r6
ORivanticonnect_secureMatch9.1r7
ORivanticonnect_secureMatch9.1r8
ORivanticonnect_secureMatch9.1r8.1
ORivanticonnect_secureMatch9.1r8.2
ORivanticonnect_secureMatch9.1r9
ORivanticonnect_secureMatch9.1r9.1
ORivanticonnect_secureMatch21.9r1
ORivanticonnect_secureMatch21.12r1
ORivanticonnect_secureMatch22.1r1
ORivanticonnect_secureMatch22.1r6
ORivanticonnect_secureMatch22.2-
ORivanticonnect_secureMatch22.2r1
ORivanticonnect_secureMatch22.3r1
ORivanticonnect_secureMatch22.4r1
ORivanticonnect_secureMatch22.4r2.1
ORivanticonnect_secureMatch22.6-
ORivanticonnect_secureMatch22.6r1
ORivanticonnect_secureMatch22.6r2
ORivanticonnect_secureMatch22.6r2.1
ORivantipolicy_secureMatch9.0-
ORivantipolicy_secureMatch9.0r1
ORivantipolicy_secureMatch9.0r2
ORivantipolicy_secureMatch9.0r2.1
ORivantipolicy_secureMatch9.0r3
ORivantipolicy_secureMatch9.0r3.1
ORivantipolicy_secureMatch9.0r4
ORivantipolicy_secureMatch9.1-
ORivantipolicy_secureMatch9.1r1
ORivantipolicy_secureMatch9.1r10
ORivantipolicy_secureMatch9.1r11
ORivantipolicy_secureMatch9.1r12
ORivantipolicy_secureMatch9.1r13
ORivantipolicy_secureMatch9.1r13.1
ORivantipolicy_secureMatch9.1r14
ORivantipolicy_secureMatch9.1r15
ORivantipolicy_secureMatch9.1r16
ORivantipolicy_secureMatch9.1r17
ORivantipolicy_secureMatch9.1r18
ORivantipolicy_secureMatch9.1r18.1
ORivantipolicy_secureMatch9.1r18.2
ORivantipolicy_secureMatch9.1r2
ORivantipolicy_secureMatch9.1r3
ORivantipolicy_secureMatch9.1r3.1
ORivantipolicy_secureMatch9.1r4
ORivantipolicy_secureMatch9.1r4.1
ORivantipolicy_secureMatch9.1r4.2
ORivantipolicy_secureMatch9.1r4.3
ORivantipolicy_secureMatch9.1r5
ORivantipolicy_secureMatch9.1r6
ORivantipolicy_secureMatch9.1r7
ORivantipolicy_secureMatch9.1r8
ORivantipolicy_secureMatch9.1r8.1
ORivantipolicy_secureMatch9.1r8.2
ORivantipolicy_secureMatch9.1r9
ORivantipolicy_secureMatch22.1r1
ORivantipolicy_secureMatch22.1r6
ORivantipolicy_secureMatch22.2r1
ORivantipolicy_secureMatch22.2r3
ORivantipolicy_secureMatch22.3r1
ORivantipolicy_secureMatch22.3r3
ORivantipolicy_secureMatch22.4r1
ORivantipolicy_secureMatch22.4r2
ORivantipolicy_secureMatch22.4r2.1
ORivantipolicy_secureMatch22.5r1
ORivantipolicy_secureMatch22.6r1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:* |
| ivanti | connect_secure | 9.0 | cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "unaffected",
"vendor": "Ivanti",
"product": "ICS",
"versions": [
{
"version": "9.1R18",
"status": "affected",
"lessThanOrEqual": "9.1R18",
"versionType": "semver"
},
{
"version": "22.6R2",
"status": "affected",
"lessThanOrEqual": "22.6R2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"vendor": "Ivanti",
"product": "IPS",
"versions": [
{
"version": "9.1R18",
"status": "affected",
"lessThanOrEqual": "9.1R18",
"versionType": "semver"
},
{
"version": "22.6R1",
"status": "affected",
"lessThanOrEqual": "22.6R1",
"versionType": "semver"
}
]
}
]Social References
More
Related
saint
saint
Ivanti Connect Secure Server-Side Request Forgery
2024-02-05 00:00:00
Ivanti Connect Secure Server-Side Request Forgery
2024-02-05 00:00:00
vulnrichment
vulnrichment
CVE-2024-21888
2024-01-31 17:51:34
nvd
nvd
CVE-2024-21888
2024-01-31 18:15:47
cvelist
cvelist
CVE-2024-21888
2024-01-31 17:51:34
prion
prion
Privilege escalation
2024-01-31 18:15:00
hivepro
hivepro
Ivanti Addresses Zero-Day Vulnerability Exploited in Attacks
2024-02-02 15:18:18
thn
thn
malwarebytes
malwarebytes
Ivanti urges customers to patch yet another critical vulnerability
2024-02-09 18:13:42
CISA: Disconnect vulnerable Ivanti products TODAY
2024-02-02 14:18:43
wizblog
wizblog
githubexploit
githubexploit
Exploit for Improper Authentication in Ivanti Connect Secure
2024-01-19 02:12:11
metasploit
metasploit
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-02-06 11:49:04
zdt
zdt
Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit
2024-02-21 00:00:00
nessus
nessus
Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities
2024-01-10 00:00:00
Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities
2024-02-09 00:00:00
attackerkb
attackerkb
CVE-2024-21893
2024-01-31 00:00:00
ics
ics
rapid7blog
rapid7blog
Zero-Day Exploitation of Ivanti Connect Secure and Policy Secure Gateways
2024-01-11 13:00:40
packetstorm
packetstorm
Ivanti Connect Secure Unauthenticated Remote Code Execution
2024-02-21 00:00:00
CVSS3
8.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
9.1
Confidence
High
EPSS
0.001
Percentile
19.3%
Related for CVE-2024-21888