This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti fixes 2 high-severity vulnerabilities in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons

Ivanti fixes 2 high-severity vulnerabilities found in Ivanti Connect Secure, Ivanti Policy Secure and Ivanti Neurons for ZTA. Fixes for Ivanti Connect Secure were released in versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1, and for ZTA in version 22.6R1.3. Further fixes are expected to be released gradually.[1]

Ivanti - privilege escalation (CVE-2024-21888)
CVSS 7.2 (High)

An authenticated remote attacker can elevate their privileges to administrator level [1]. The impact of the vulnerabilities can be mitigated by importing the file mitigation.release.20240126.5.xml through the download portal [2]; its effect on functionality can be found here [3].

CVSS: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:L

More information:

The vulnerability was publicly disclosed 22. 1. 2024.

Ivanti - Server-side request forgery (CVE-2024-21893)
CVSS 8.2 (High)

An unauthenticated remote attacker can access certain resources without authentication [1]. The vulnerability CVE-2024-21893 is already being actively exploited and CISA has added it to its catalog of known exploited vulnerabilities [4]. The impact of the vulnerabilities can be mitigated by importing the file mitigation.release.20240126.5.xml through the download portal [2]; its effect on functionality can be found here [3].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 22. 1. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 2. 2. 2024.

CESNET, z.s.p.o. Logo