Frequently asked questions for five CVEs affecting Ivanti Connect Secure and Policy Secure Gateways, with three of the vulnerabilities having been exploited in the wild as zero-days.

CVE-2023-46805, CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893: Frequently Asked Questions for Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

Two zero-day vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure have been exploited in the wild, with at least one attack attributed to nation-state actors.

CVE-2023-46805, CVE-2024-21887: Zero-Day Vulnerabilities Exploited in Ivanti Connect Secure and Policy Secure Gateways

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Policy Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Ivanti Policy Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by an authentication bypass vulnerability in the web component of Ivanti Policy Secure (9.x, 22.x) which allows a remote attacker to access restricted resources by bypassing control checks.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by an authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) which allows a remote attacker to access restricted resources by bypassing control checks.

Ivanti Connect Secure 9.x, 22.x suffers from an authentication bypass vulnerability.

By crafting a specific HTTP request, a remote and unauthenticated attacker could exploit this vulnerability to bypass authentication and authorization requirements.

The Ivanti Connect Secure installed on the remote host is 9.x or 22.x. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy     Secure allows a remote attacker to access restricted resources by bypassing control checks. (CVE-2023-46805)

  - A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the     appliance. This vulnerability can be exploited over the internet. (CVE-2024-21887)

  - A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure     (9.x, 22.x) allows a user to elevate privileges to that of an administrator. (CVE-2024-21888)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
190367	Ivanti Policy Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	critical
189949	Ivanti Policy Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)	Nessus	CGI abuses	high
189948	Ivanti Connect Secure 9.x / 22.x Authentication Bypass Vulnerability (CVE-2023-46805)	Nessus	CGI abuses	high
114165	Ivanti Connect Secure 9.x / 22.x Authentication Bypass	Web App Scanning	Component Vulnerability	critical
187908	Ivanti Connect Secure 9.x / 22.x Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-46805

critical

Tenable Plugins

critical

high

high

critical

critical