CVE-2024-21888

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
Ivanti	ICS	>= 9.1R18, <= 9.1R18; >= 22.6R2, <= 22.6R2
Ivanti	IPS	>= 9.1R18, <= 9.1R18; >= 22.6R1, <= 22.6R1
ivanti	connect_secure	>= 9.0, < 10.0
ivanti	connect_secure	>= 22.0, < 23.0
ivanti	policy_secure	>= 22.0, < 23.0
ivanti	policy_secure	>= 9.0, < 10.0

References

Timeline

Published: Jan 31, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-21896.1The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which cou CVE-2024-218906.5The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. CVE-2024-218918.8Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d CVE-2024-218927.8On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with CVE-2024-218938.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) CVE-2024-218949.8A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-218969.8The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is CVE-2024-218975.4A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabili CVE-2024-218988.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-218999.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-219006.5An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow a CVE-2024-219014.7A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administrat