CVE Vulnerabilities

CVE-2024-21893

Server-Side Request Forgery (SSRF)

Published: Jan 31, 2024 | Modified: Jan 31, 2024
CVSS 3.x
8.2
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Weakness

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected Software

Name Vendor Start Version End Version
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.0 9.0
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 9.1 9.1
Connect_secure Ivanti 21.9 21.9
Connect_secure Ivanti 21.12 21.12
Connect_secure Ivanti 22.1 22.1
Connect_secure Ivanti 22.1 22.1
Connect_secure Ivanti 22.2 22.2
Connect_secure Ivanti 22.2 22.2
Connect_secure Ivanti 22.3 22.3
Connect_secure Ivanti 22.4 22.4
Connect_secure Ivanti 22.4 22.4
Connect_secure Ivanti 22.6 22.6
Connect_secure Ivanti 22.6 22.6
Connect_secure Ivanti 22.6 22.6
Connect_secure Ivanti 22.6 22.6
Neurons_for_zero-trust_access Ivanti - -
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.0 9.0
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 9.1 9.1
Policy_secure Ivanti 22.1 22.1
Policy_secure Ivanti 22.1 22.1
Policy_secure Ivanti 22.2 22.2
Policy_secure Ivanti 22.2 22.2
Policy_secure Ivanti 22.3 22.3
Policy_secure Ivanti 22.3 22.3
Policy_secure Ivanti 22.4 22.4
Policy_secure Ivanti 22.4 22.4
Policy_secure Ivanti 22.4 22.4
Policy_secure Ivanti 22.5 22.5
Policy_secure Ivanti 22.6 22.6

References