The vulnerability of the SAML components in Ivanti Connect Secure and Ivanti Policy Secure access control tools allows a perpetrator to disclose protected information.

🗓️ 06 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

SAML flaws in Ivanti Connect Secure and Ivanti Policy Secure enable disclosure due to insufficient request validation.

Reporter	Title	Published	Views	Family All 77
0day.today	Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit	21 Feb 202400:00	–	zdt
GithubExploit	Exploit for Command Injection in Ivanti Connect_Secure	3 Feb 202411:33	–	githubexploit
GithubExploit	Exploit for Server-Side Request Forgery in Ivanti Connect_Secure	2 Feb 202422:59	–	githubexploit
ICS	Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways	29 Feb 202412:00	–	ics
ATTACKERKB	CVE-2024-21893	31 Jan 202400:00	–	attackerkb
Information Security Automation	February 2024: Vulremi, Vuldetta, PT VM Course relaunch, PT TrendVulns digests, Ivanti, Fortinet, MSPT, Linux PW	5 Mar 202418:43	–	avleonov
BDU FSTEC	The vulnerability of the web components of Ivanti Connect Secure and Ivanti Policy Secure control tools allows a perpetrator to…	6 Feb 202400:00	–	bdu_fstec
Circl	CVE-2024-21888	10 Jan 202420:21	–	circl
Circl	CVE-2024-21893	10 Jan 202420:21	–	circl
CISA KEV Catalog	Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability	31 Jan 202400:00	–	cisa_kev

Vulners

Node

ivanti connect_secureRange<9.1r14.4

OR

ivanti connect_secureRange<9.1r17.2

OR

ivanti connect_secureRange<9.1r18.3

OR

ivanti connect_secureRange<22.4r2.2

OR

ivanti connect_secureRange<22.5r1.1

OR

ivanti connect_secureRange<22.5r2.2

OR

ivanti policy_secureRange<22.5r1.1

OR

ivanti policy_secureRange<22.6r1.3

Source	Link
forums	www.forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.9High risk

Vulners AI Score7.9

CVSS 38.2

CVSS 28.5

EPSS0.99999

Ivanti Connect Secure Ivanti Policy Secure SAML components Request validation Protected information