Exploit / PoCcriticalExploited in the wild

Ivanti warns of a new actively exploited zero

Security Affairsby @securityaffairsJan 31, 2024 · 14:37 UTC (Jan 31, 2024)2 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2024-21888 CVE-2024-21893 CVE-2023-46805 CVE-2024-21887

Tags: cve-2024-21888 cve-2024-21893 cve-2023-46805 cve-2024-21887 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2024-21888	A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate…	8.8	87%		Jan 31, 2024
CVE-2024-21893	SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component	8.2	100%	KEVRansomware	Jan 31, 2024 KEV Jan 31, 2024

From the original article

2 min read at securityaffairs.com

Ivanti warns of two new vulnerabilities in its Connect Secure and Policy Secure products, one of which is actively exploited in the wild. Ivanti is warning of two new high-severity vulnerabilities in its Connect Secure and Policy Secure solutions respectively tracked as CVE-2024-21888 (CVSS score: 8. 8) and CVE-2024-21893 (CVSS score: 8.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.