Description
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons contain a server-side request forgery (SSRF) vulnerability in the SAML component that allows an attacker to access certain restricted resources without authentication.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| connect_secure | ivanti / connect_secure | 21.12 | affected |
| connect_secure | ivanti / connect_secure | 21.9 | affected |
| connect_secure | ivanti / connect_secure | 22.1 | affected |
| connect_secure | ivanti / connect_secure | 22.2 | affected |
| connect_secure | ivanti / connect_secure | 22.3 | affected |
| connect_secure | ivanti / connect_secure | 22.4 | affected |
| connect_secure | ivanti / connect_secure | 22.6 | affected |
| connect_secure | ivanti / connect_secure | 9.0 | affected |
| connect_secure | ivanti / connect_secure | 9.1 | affected |
| ICS | Ivanti / ICS | >= 22.6R2, <= 22.6R2 | affected |
| ICS | Ivanti / ICS | >= 9.1R18, <= 9.1R18 | affected |
| IPS | Ivanti / IPS | >= 22.6R1, <= 22.6R1 | affected |
| IPS | Ivanti / IPS | >= 9.1R18, <= 9.1R18 | affected |
| policy_secure | ivanti / policy_secure | 22.1 | affected |
| policy_secure | ivanti / policy_secure | 22.2 | affected |
| policy_secure | ivanti / policy_secure | 22.3 | affected |
| policy_secure | ivanti / policy_secure | 22.4 | affected |
| policy_secure | ivanti / policy_secure | 22.5 | affected |
| policy_secure | ivanti / policy_secure | 22.6 | affected |
| policy_secure | ivanti / policy_secure | 9.0 | affected |
| policy_secure | ivanti / policy_secure | 9.1 | affected |