CVE-2024-21893
31.01.2024, 18:15
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect_secure | 9.0 |
| ivanti | connect_secure | 9.0:r1 |
| ivanti | connect_secure | 9.0:r2 |
| ivanti | connect_secure | 9.0:r2.1 |
| ivanti | connect_secure | 9.0:r3 |
| ivanti | connect_secure | 9.0:r3.1 |
| ivanti | connect_secure | 9.0:r3.2 |
| ivanti | connect_secure | 9.0:r3.3 |
| ivanti | connect_secure | 9.0:r3.5 |
| ivanti | connect_secure | 9.0:r4 |
| ivanti | connect_secure | 9.0:r4.1 |
| ivanti | connect_secure | 9.0:r5.0 |
| ivanti | connect_secure | 9.0:r6.0 |
| ivanti | connect_secure | 9.1:r1 |
| ivanti | connect_secure | 9.1:r10 |
| ivanti | connect_secure | 9.1:r11 |
| ivanti | connect_secure | 9.1:r11.3 |
| ivanti | connect_secure | 9.1:r11.4 |
| ivanti | connect_secure | 9.1:r11.5 |
| ivanti | connect_secure | 9.1:r12 |
| ivanti | connect_secure | 9.1:r12.1 |
| ivanti | connect_secure | 9.1:r13 |
| ivanti | connect_secure | 9.1:r13.1 |
| ivanti | connect_secure | 9.1:r14 |
| ivanti | connect_secure | 9.1:r15 |
| ivanti | connect_secure | 9.1:r15.2 |
| ivanti | connect_secure | 9.1:r16 |
| ivanti | connect_secure | 9.1:r16.1 |
| ivanti | connect_secure | 9.1:r17 |
| ivanti | connect_secure | 9.1:r17.1 |
| ivanti | connect_secure | 9.1:r18 |
| ivanti | connect_secure | 9.1:r18.1 |
| ivanti | connect_secure | 9.1:r18.2 |
| ivanti | connect_secure | 9.1:r2 |
| ivanti | connect_secure | 9.1:r3 |
| ivanti | connect_secure | 9.1:r4 |
| ivanti | connect_secure | 9.1:r4.1 |
| ivanti | connect_secure | 9.1:r4.2 |
| ivanti | connect_secure | 9.1:r4.3 |
| ivanti | connect_secure | 9.1:r5 |
| ivanti | connect_secure | 9.1:r6 |
| ivanti | connect_secure | 9.1:r7 |
| ivanti | connect_secure | 9.1:r8 |
| ivanti | connect_secure | 9.1:r8.1 |
| ivanti | connect_secure | 9.1:r8.2 |
| ivanti | connect_secure | 9.1:r9 |
| ivanti | connect_secure | 9.1:r9.1 |
| ivanti | connect_secure | 21.9:r1 |
| ivanti | connect_secure | 21.12:r1 |
| ivanti | connect_secure | 22.1:r1 |
| ivanti | connect_secure | 22.1:r6 |
| ivanti | connect_secure | 22.2 |
| ivanti | connect_secure | 22.2:r1 |
| ivanti | connect_secure | 22.3:r1 |
| ivanti | connect_secure | 22.4:r1 |
| ivanti | connect_secure | 22.4:r2.1 |
| ivanti | connect_secure | 22.6 |
| ivanti | connect_secure | 22.6:r1 |
| ivanti | connect_secure | 22.6:r2 |
| ivanti | connect_secure | 22.6:r2.1 |
| ivanti | policy_secure | 9.0 |
| ivanti | policy_secure | 9.0:r1 |
| ivanti | policy_secure | 9.0:r2 |
| ivanti | policy_secure | 9.0:r2.1 |
| ivanti | policy_secure | 9.0:r3 |
| ivanti | policy_secure | 9.0:r3.1 |
| ivanti | policy_secure | 9.0:r4 |
| ivanti | policy_secure | 9.1 |
| ivanti | policy_secure | 9.1:r1 |
| ivanti | policy_secure | 9.1:r10 |
| ivanti | policy_secure | 9.1:r11 |
| ivanti | policy_secure | 9.1:r12 |
| ivanti | policy_secure | 9.1:r13 |
| ivanti | policy_secure | 9.1:r13.1 |
| ivanti | policy_secure | 9.1:r14 |
| ivanti | policy_secure | 9.1:r15 |
| ivanti | policy_secure | 9.1:r16 |
| ivanti | policy_secure | 9.1:r17 |
| ivanti | policy_secure | 9.1:r18 |
| ivanti | policy_secure | 9.1:r18.1 |
| ivanti | policy_secure | 9.1:r18.2 |
| ivanti | policy_secure | 9.1:r2 |
| ivanti | policy_secure | 9.1:r3 |
| ivanti | policy_secure | 9.1:r3.1 |
| ivanti | policy_secure | 9.1:r4 |
| ivanti | policy_secure | 9.1:r4.1 |
| ivanti | policy_secure | 9.1:r4.2 |
| ivanti | policy_secure | 9.1:r4.3 |
| ivanti | policy_secure | 9.1:r5 |
| ivanti | policy_secure | 9.1:r6 |
| ivanti | policy_secure | 9.1:r7 |
| ivanti | policy_secure | 9.1:r8 |
| ivanti | policy_secure | 9.1:r8.1 |
| ivanti | policy_secure | 9.1:r8.2 |
| ivanti | policy_secure | 9.1:r9 |
| ivanti | policy_secure | 22.1:r1 |
| ivanti | policy_secure | 22.1:r6 |
| ivanti | policy_secure | 22.2:r1 |
| ivanti | policy_secure | 22.2:r3 |
| ivanti | policy_secure | 22.3:r1 |
| ivanti | policy_secure | 22.3:r3 |
| ivanti | policy_secure | 22.4:r1 |
| ivanti | policy_secure | 22.4:r2 |
| ivanti | policy_secure | 22.4:r2.1 |
| ivanti | policy_secure | 22.5:r1 |
| ivanti | policy_secure | 22.6:r1 |
| ivanti | neurons_for_zero-trust_access | - |
| ivanti | neurons_for_zero-trust_access | 22.2:r1 |
| ivanti | neurons_for_zero-trust_access | 22.2:r4 |
| ivanti | neurons_for_zero-trust_access | 22.2:r5 |
| ivanti | neurons_for_zero-trust_access | 22.3:r1 |
| ivanti | neurons_for_zero-trust_access | 22.3:r4 |
| ivanti | neurons_for_zero-trust_access | 22.4:r1 |
| ivanti | neurons_for_zero-trust_access | 22.4:r3 |
| ivanti | neurons_for_zero-trust_access | 22.5:r1 |
| ivanti | neurons_for_zero-trust_access | 22.5:r1.2 |
| ivanti | neurons_for_zero-trust_access | 22.6:r1 |
| ivanti | neurons_for_zero-trust_access | 22.6:r1.2 |
𝑥
= Vulnerable software versions