COOEY // HUBcompliance · community · intelligence

Exposures › CVE-2024-21887

CVE-2024-21887

Severity
critical · on CISA KEV actively exploited
Source
CISA-KEV · kev
Published
2024-01-10
Reference
https://nvd.nist.gov/vuln/detail/CVE-2024-21887
⚡ RCE ◐ zero-day ⌖ exploited in the wild shame 95/100 ransomwarerceexploited-in-wildzero-day

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appl

Players implicated

Ivanti · vendorConnect Secure and Policy Secure · product

Description

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

Affected FedRAMP products 2 in the catalog

ProductProviderStatusMatch
Ivanti Neurons for ITSM (Formerly Service Manager) Ivanti Authorized vendor-exact · 0.90
Ivanti Neurons for MDM (Formerly MobileIron) Ivanti Authorized vendor-exact · 0.90