CVE-2024-21893

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 9.x and 22.x Ivanti Policy Secure versions 9.x and 22.x Ivanti Neurons for ZTA (affected versions not specified)

Description A server-side request forgery (SSRF) issue exists in the SAML component of the affected software due to insufficient validation of incoming requests. This allows an unauthenticated remote attacker to access restricted resources, disclose protected information, or escalate privileges. Real-world exploitation has been recorded in conjunction with other flaws to achieve remote code execution. Approximately 237,543 devices are potentially affected worldwide, primarily distributed in the United States and China.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.