Description (CNA)
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Ivanti / ICS | affected 9.1R18 through 9.1R18; affected 22.6R2 through 22.6R2 |
| Ivanti / IPS | affected 9.1R18 through 9.1R18; affected 22.6R1 through 22.6R1 |
CWE
No CWE identifiers supplied.
References
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html
ADP enrichment
No English description supplied.
No English description supplied.