Kevin Beaumont on Nostr: More hilarity on #ConnectAround - there’s now two NEW vulnerabilities in Ivanti ...
More hilarity on #ConnectAround - there’s now two NEW vulnerabilities in Ivanti Pulse Secure, being actively exploited as zero days too - no patches.
Updated advisory with updated mitigations you need to reapply:
https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVEs: CVE-2024-21893 and CVE-2024-21888
CERT advisory: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-205101-1032.pdf?__blob=publicationFile&v=2
HT npub1eg705tw0h4uuc5leamapf4q9v9twld2ys6nl5wzpg4ap8u90mtmqesgrx6 (npub1eg7…grx6)
#threatintel
Updated advisory with updated mitigations you need to reapply:
https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
CVEs: CVE-2024-21893 and CVE-2024-21888
CERT advisory: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2024/2024-205101-1032.pdf?__blob=publicationFile&v=2
HT npub1eg705tw0h4uuc5leamapf4q9v9twld2ys6nl5wzpg4ap8u90mtmqesgrx6 (npub1eg7…grx6)
#threatintel