CVE-2024-21887
CRITICAL CISA KEVDescription
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVSS v3.1 Score
CISA Known Exploited Vulnerability
This vulnerability is actively exploited in the wild.
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | connect_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
| ivanti | policy_secure |
References
Advisories & Patches
Exploits
Frequently Asked Questions
What is CVE-2024-21887? +
How severe is CVE-2024-21887? +
What products are affected by CVE-2024-21887? +
How do I check if I'm vulnerable to CVE-2024-21887? +
Related Vulnerabilities
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, symbol arguments …
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to version 2.9.0, due to the …
Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2, R323.x, R330.1 contains a command …
Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found …
The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management …
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary …