PT-2023-8231 · Ivanti · Ivanti Connect Secure+1
Published
2023-01-24
·
Updated
2026-06-18
·
CVE-2024-21887
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ivanti Connect Secure versions 9.x
Ivanti Connect Secure versions 22.x
Ivanti Policy Secure versions 9.x
Ivanti Policy Secure versions 22.x
Description
A command injection issue exists in the web components of the software. This occurs because the system fails to properly neutralize special elements used in operating system commands. An authenticated administrator can exploit this by sending specially crafted requests to execute arbitrary commands on the appliance.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Ivanti Connect Secure
Ivanti Policy Secure