CVE-2024-21893
Summary
| CVE | CVE-2024-21893 |
|---|---|
| State | PUBLISHED |
| Assigner | hackerone |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-31 18:15:47 UTC |
| Updated | 2026-08-04 05:16:30 UTC |
| Description | A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. |
Risk And Classification
Primary CVSS: v3.1 8.2 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS: 0.999990000 probability, percentile 0.999990000 (date 2026-08-23)
CISA KEV: Listed on 2024-01-31; due 2024-02-02; ransomware use Known
Problem Types: CWE-918 | CWE-918 CWE-918 Server-Side Request Forgery (SSRF)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| 3.0 | [email protected] | Secondary | 8.2 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| 3.0 | CNA | DECLARED | 8.2 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
LowAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CISA Known Exploited Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Connect Secure, Policy Secure, and Neurons |
| Name | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability |
| Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Notes | https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21893 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ivanti | Connect Secure | 21.12 | r1 | All | All |
| Application | Ivanti | Connect Secure | 21.9 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 22.2 | - | All | All |
| Application | Ivanti | Connect Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | - | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r2 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | - | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.3 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r3.5 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r5.0 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | r6.0 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9.1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | - | All | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.2 | r1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.2 | r4 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.2 | r5 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.3 | r1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.3 | r4 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.4 | r1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.4 | r3 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.5 | r1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.5 | r1.2 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.6 | r1 | All | All |
| Application | Ivanti | Neurons For Zero-trust Access | 22.6 | r1.2 | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 22.5 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | - | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r2 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r3 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r3.1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | r4 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | - | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r9 | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Ivanti | ICS | affected 9.1R18 9.1R18 semver | Not specified |
| CNA | Ivanti | ICS | affected 22.6R2 22.6R2 semver | Not specified |
| CNA | Ivanti | IPS | affected 9.1R18 9.1R18 semver | Not specified |
| CNA | Ivanti | IPS | affected 22.6R1 22.6R1 semver | Not specified |
| ADP | Ivanti | Connect Secure | affected 9.0 | Not specified |
| ADP | Ivanti | Connect Secure | affected 22.6 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.3 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.6 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.5 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.4 | Not specified |
| ADP | Ivanti | Connect Secure | affected 22.1 | Not specified |
| ADP | Ivanti | Connect Secure | affected 22.2 | Not specified |
| ADP | Ivanti | Connect Secure | affected 9.1 | Not specified |
| ADP | Ivanti | Connect Secure | affected 21.9 | Not specified |
| ADP | Ivanti | Connect Secure | affected 21.12 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.2 | Not specified |
| ADP | Ivanti | Policy Secure | affected 22.1 | Not specified |
| ADP | Ivanti | Policy Secure | affected 9.1 | Not specified |
| ADP | Ivanti | Connect Secure | affected 22.4 | Not specified |
| ADP | Ivanti | Connect Secure | affected 22.3 | Not specified |
| ADP | Ivanti | Policy Secure | affected 9.0 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| Ivanti Community | af854a3a-2127-422b-91ae-364da2661108 | forums.ivanti.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2024-01-31T00:00:00.000Z | CVE-2024-21893 added to CISA KEV |