4.9Media
Ivanti Endpoint Manager Mobile
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.
8.8Alta
KEV
CVE-2021-22894Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Explotación conocida — Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.05.2022.
Acción requerida: Apply updates per vendor instructions. Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22894
Descripción
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| ivanti | connect secure | 9.0 | |
| — | Pulse Connect Secure | Fixed version 9.1R11.4 |
Referencias y parches
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/?kA23Z000000boUWSAY Broken LinkVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22894 US Government Resource
Coincidencias CPE (NVD) (40)
cpe:2.3:a:ivanti:connect_secure:9.0:-:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r1.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r2.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r2.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3.3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r3.5:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r4:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r4.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r4.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r5.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.0:r6.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r10.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r11.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r11.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r11.3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r8.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r8.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r8.4:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r9.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:9.1:r9.2:*:*:*:*:*:*