What is CVE-2024-21888?

CVE-2024-21888 is a high-severity privilege escalation vulnerability affecting the web component of Ivanti Connect Secure and Ivanti Policy Secure software. This vulnerability allows a user to elevate their privileges to that of an administrator, potentially compromising the security of systems running the affected software versions. It is crucial for organizations using these systems to be aware of this vulnerability and take appropriate measures to protect their resources.

Who is impacted?

The CVE-2024-21888 vulnerability affects users of Ivanti Connect Secure and Ivanti Policy Secure software, specifically versions 9.x and 22.x. This high-severity privilege escalation vulnerability can potentially compromise the security of systems running these affected software versions. It is important for organizations using these systems to be aware of this vulnerability and take appropriate measures to protect their resources.

What to do if CVE-2024-21888 affected you

If you're affected by the CVE-2024-21888 vulnerability, it's important to take action to protect your systems. Follow these steps:

1. Apply the available patch for your Ivanti Connect Secure or Ivanti Policy Secure software version. See the Ivanti forum post for patch details.

2. Follow the instructions in the provided KB article to apply the mitigation and patch as each version becomes available.

3. Monitor updates and seek support through the Success Portal if needed.

Is it in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-21888 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. It is a privilege escalation vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure software. The vulnerability was published on January 31, 2024. No due date or required action is mentioned in the catalog, but users should apply available patches and follow instructions to protect their systems.

Weakness Enumeration

The weakness enumeration for this vulnerability is Insufficient Information, indicating a lack of specific details about the vulnerability and its mitigation.

Learn More

CVE-2024-21888 is a high-severity privilege escalation vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure software. For a comprehensive understanding of the vulnerability, its severity, technical details, and affected software configurations, refer to the NVD page.

• CVE-2024-21888 Privilege Escalation for Ivanti Connect Secure and Ivanti Policy Secure

• CVE Record | CVE