CVE-2024-21893

State: Published
Severity: 8.2 High
Published: Jan 31, 2024
Updated: Aug 4, 2026
Reserved: Jan 3, 2024

Description

A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.

Scores

CVSS	Score	Vector	Source
3.0	8.2 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N	hackerone

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
ICSIvanti	9.1R18 through 9.1R18Affected 22.6R2 through 22.6R2Affected
IPSIvanti	9.1R18 through 9.1R18Affected 22.6R1 through 22.6R1Affected

References

https://forums.ivanti.com/s/article/CVE-2024-21888-Privilege-Escalation-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21893government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.