Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
SSRF in Ivanti Connect Secure, Policy Secure and Neurons (CVE-2024-21893) - Vulnerability Database

SSRF in Ivanti Connect Secure, Policy Secure and Neurons (CVE-2024-21893)

Description

The Ivanti Connect Secure, Policy Secure Gate and Neurons have an SSRF (server-side request forgery) vulnerability. An attacker can use this vulnerability to bypass the fix for the authentication bypass vulnerability (CVE-2023-46805) and exploit the RCE vulnerability (CVE-2024-21887) to compromise the system.

Remediation

Upgrade to the latest version of Ivanti Connect Secure / Policy Secure / Neurons

References

CVE-2024-21893
CVE-2024-21888 Privilege Escalation for Ivanti Connect Secure and Ivanti Policy Secure

Related Vulnerabilities

Apache OFBiz SSRF (CVE-2024-45507) Critical
Common tags: SSRF Known Vulnerabilities Acumonitor
Apache Solr SSRF CVE-2017-3164 Medium
Common tags: SSRF Known Vulnerabilities Acumonitor
TorchServe Management API SSRF (CVE-2023-43654) Critical
Common tags: SSRF Known Vulnerabilities Acumonitor
Oracle Business Intelligence ReportTemplateService XXE CVE-2019-2616 High
Common tags: SSRF Known Vulnerabilities Acumonitor
GeoServer WMS SSRF (CVE-2023-43795) High
Common tags: SSRF Known Vulnerabilities Acumonitor

Severity

High

Classification

CVE-2024-21893
CWE-918
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

SSRF
Known Vulnerabilities
Acumonitor