CVE-2024-21887

CRITICAL9.1

A command injection vulnerability in web components of Ivanti Connect Secure (9

Published Jan 12, 2024

Modified 6 months ago

Details

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

References

WEB

http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html

WEB

https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

WEB

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2024-21887

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.1/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Ecosystems

Timeline

PublishedJan 12, 2024

ModifiedOct 21, 2025

CVE-2024-21887 | Mondoo Vulnerability Intelligence