Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
Summary
| CVE | CVE-2024-21893 |
|---|---|
| State | PUBLISHED |
| Assigner | Unknown |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-31 18:15:00 UTC |
| Updated | 2024-02-01 02:00:00 UTC |
| Description | Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication. |
Risk And Classification
EPSS: 0.943190000 probability, percentile 0.999500000 (date 2026-04-21)
CISA KEV: Listed on 2024-01-31; due 2024-02-02; ransomware use Known
Problem Types: CWE-918
CISA Known Exploited Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Connect Secure, Policy Secure, and Neurons |
| Name | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability |
| Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Notes | https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ivanti | Connect Secure | 21.12 | r1 | All | All |
| Application | Ivanti | Connect Secure | 21.9 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 22.2 | - | All | All |
| Application | Ivanti | Connect Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | - | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r2 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | - | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.5 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r5.0 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r6.0 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9.1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | - | All | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 22.5 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | - | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r2 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r3 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r3.1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r4 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | - | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r9 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Ivanti Community | forums.ivanti.com | Vendor Advisory | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.