CVSS: 8.2EPSS: 95%CPEs: 107EXPL: 2CVE-2024-21893 – Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
https://notcve.org/view.php?id=CVE-2024-21893
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication. Una vulnerabilidad de server-side request forgery en el componente SAML de Ivanti Connect Secure (9.x, 22.x) e Ivanti Policy Secure (9.x, 22.x) e Ivanti Neurons for ZTA permite a un atacante acceder a ciertos recursos restringidos sin autenticación. Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication. • https://github.com/Chocapikk/CVE-2024-21893-to-CVE-2024-21887 https://github.com/h4x0r-dz/CVE-2024-21893.py https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US https://attackerkb.com/topics/FGlK1TVnB2/cve-2024-21893/rapid7-analysis https://attackerkb.com/topics/AdUh6by52K/cve-2023-46805/rapid7-analysis https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy& • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2022-35254
https://notcve.org/view.php?id=CVE-2022-35254
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. Un atacante no autenticado puede provocar una Denegación de Servicio (DoS) a los siguientes productos: Ivanti Connect Secure (ICS) en versiones anteriores a 9.1R14.3, 9.1R15.2, 9.1R16.2 y 22.2R4, Ivanti Policy Secure (IPS ) en versiones anteriores a 9.1R17 y 22.3R1, e Ivanti Neurons for Zero-Trust Access en versiones anteriores a 22.3R1. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW • CWE-400: Uncontrolled Resource Consumption CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 76EXPL: 0CVE-2022-35258
https://notcve.org/view.php?id=CVE-2022-35258
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1. Un atacante no autenticado puede provocar una Denegación de Servicio (DoS) a los siguientes productos: Ivanti Connect Secure (ICS) en versiones anteriores a 9.1R14.3, 9.1R15.2, 9.1R16.2 y 22.2R4, Ivanti Policy Secure (IPS ) en versiones anteriores a 9.1R17 y 22.3R1, e Ivanti Neurons for Zero-Trust Access en versiones anteriores a 22.3R1. • https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA45520/?kA23Z000000GH5OSAW • CWE-128: Wrap-around Error CWE-682: Incorrect Calculation •