Privilege Escalation Vulnerability Affects Ivanti Connect Secure and Policy Secure

CVE-2024-21888
8.8HIGH

Key Information

Vendor
Ivanti
Status
ICS
IPS
Vendor
CVE Published:
31 January 2024

Badges

👾 Exploit Exists📰 News Worthy

Summary

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.

Affected Version(s)

ICS <= 9.1R18

ICS <= 22.6R2

IPS <= 9.1R18

News Articles

favicon imageThe Record by Recorded Future

Two new Ivanti bugs discovered as CISA warns of hackers bypassing mitigations

IT company Ivanti said this week that it discovered two new vulnerabilities affecting its products while investigating bugs discovered earlier in the month.

8 months ago

favicon imageCyber Kendra

Two New Zero-Day Flaws Disclosed in Ivanti Products, One Under Active Exploitation - Cyber Kendra

Two New Zero-Day Flaws Disclosed in Ivanti Products, One Under Active Exploitation

8 months ago

favicon imageDuo Security

Ivanti Rolls Out Patches For Exploited Connect Secure Flaws

Ivanti has rolled out its first round of patches for two existing - and two newly discovered - vulnerabilities in its Ivanti Connect Secure VPN and Ivanti Policy Secure appliances.

8 months ago

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • First article discovered by Dark Reading

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database5 News Article(s)
.