CVE-2024-21888

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions 9.x through 22.x Ivanti Policy Secure versions 9.x through 22.x

Description A privilege escalation vulnerability in the web component of Ivanti Connect Secure and Ivanti Policy Secure allows a user to elevate privileges to that of an administrator. The issue is related to insufficient access control. An attacker can exploit this vulnerability to gain administrator privileges. There is evidence that this vulnerability is being exploited in the wild.

Recommendations For Ivanti Connect Secure versions 9.x through 22.x, update to a version that includes a fix for this vulnerability. For Ivanti Policy Secure versions 9.x through 22.x, update to a version that includes a fix for this vulnerability. As a temporary workaround, consider restricting access to the web component of Ivanti Connect Secure and Ivanti Policy Secure to minimize the risk of exploitation.