Advisorycritical
Two new Ivanti bugs discovered as CISA warns of hackers bypassing mitigations
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate… | 8.8 | 87% | ||
| CVE-2024-21893 | SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component | 8.2 | 100% | KEVRansomware | KEV |
From the original article
3 min read at therecord.media
IT company Ivanti said this week that it discovered two new vulnerabilities affecting its products while investigating bugs discovered earlier in the month. The issues affect Ivanti’s Policy Secure and Ivanti Connect Secure VPN products, which are used widely across the U. S.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.