- 105/2024
- High
- April 4, 2024
- 11:40 am
Ivanti has released security updates to fix several vulnerabilities across Ivanti Connect Secure and Policy Secure gateways.
The addressed vulnerabilities could allow the remote attacker to conduct denial of service attacks, or execute arbitrary code and gain access to the affected systems by sending specially crafted requests.
Sample of the addressed vulnerabilities:
1. Ivanti Connect Secure and Ivanti Policy Secure Gateways Code Execution Vulnerability (CVE-2024-21894):
- CVSS: 8.2
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Gain Access
2. Ivanti Connect Secure and Ivanti Policy Secure Gateways Denial of Service Vulnerability (CVE-2024-22052):
- CVSS: 7.5
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Consequences: Denial of Service
Vulnerabilities
- CVE-2024-21894
- CVE-2024-22052
- CVE-2024-22053
- CVE-2024-22023
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.