CVE-2024-21893

HighCVSS 8.2/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
IvantiICS>= 9.1R18, <= 9.1R18; >= 22.6R2, <= 22.6R2
IvantiIPS>= 9.1R18, <= 9.1R18; >= 22.6R1, <= 22.6R1
ivanticonnect_secure9.0
ivanticonnect_secure22.6
ivantipolicy_secure22.3
ivantipolicy_secure22.6
ivantipolicy_secure22.5
ivantipolicy_secure22.4
ivanticonnect_secure22.1
ivanticonnect_secure22.2
ivanticonnect_secure9.1
ivanticonnect_secure21.9
ivanticonnect_secure21.12
ivantipolicy_secure22.2
ivantipolicy_secure22.1
ivantipolicy_secure9.1
ivanticonnect_secure22.4
ivanticonnect_secure22.3
ivantipolicy_secure9.0

References

Timeline

Published
Jan 31, 2024
Last modified
Aug 4, 2026
Added to CISA KEV
Jan 31, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-218949.8A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malCVE-2024-218969.8The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path isCVE-2024-218975.4A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabiliCVE-2024-218988.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-218999.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2024-219006.5An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow aCVE-2024-219014.7A SQL injection vulnerability has been reported to affect myQNAPcloud. If exploited, the vulnerability could allow authenticated administratCVE-2024-219028.1An incorrect permission assignment for critical resource vulnerability has been reported to affect several QNAP operating system versions. ICVE-2024-219034.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2024-219046.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allCVE-2024-219058.2An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerCVE-2024-219064.7An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co
CVE-2024-21893: High severity, CVSS 8.2 | Vulnix