8.8
High
CVE-2024-21888 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure…
Description
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| connect_secure 22.0 | 22.0 → < 23.0 | 23.0 |
| policy_secure 9.0 | 9.0 → < 10.0 | 10.0 |
| ICS | 22.6R2 | No fix stated |
| ICS | 9.1R18 | No fix stated |
| IPS | 22.6R1 | No fix stated |
| IPS | 9.1R18 | No fix stated |
Other CVEs of connect_secure
The 24 CVEs of connect_secure →
CVE-2024-37400
An out of bounds read in Ivanti Connect Secure before version 22.7R2.3 allows a remote unauthenticated attacker to…
7.5
High
CVE-2024-39709
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy…
7.8
High
CVE-2024-38656
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version…
9.1
Critical
CVE-2024-39710
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version…
9.1
Critical