{"basis":"claimed","id":"CVE-2024-21887","name":"Ivanti Connect Secure and Policy Secure Command Injection Vulnerability","vendorProject":"Ivanti","product":"Connect Secure and Policy Secure","publishedAt":"2024-01-12","cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0"},"exploited":{"kevAdded":"2024-01-10","dueDate":"2024-01-22","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"blocks","firstOn":"2025-04-02","daysToRule":446},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2024-03-12","daysToRule":60},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)  allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","cwes":["CWE-77"],"vendors":[{"vendor":"cloudflare","status":"blocks","basis":"claimed","firstOn":"2025-04-02","firstIsNew":true,"daysToRule":446,"daysAtMost":null,"freePlan":false,"claims":[{"id":"1ad9da1c57640bb31692bea6b5d2c2317986d948da8889e22c4281fdfcb2602b","cve_id":"CVE-2024-21887","vendor":"cloudflare","product":"Cloudflare Managed Ruleset","rule_id":"533fbad558ce4c5ebcf013f09a5581d0","rule_name":"Ivanti - Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887, CVE:CVE-2024-22024","change":"new","default_action":"Block","published_on":"2025-04-02","source_url":"https://developers.cloudflare.com/changelog/post/2025-04-02-waf-release/","source_title":"WAF Release - 2025-04-02","excerpt":"Ivanti - Command Injection - CVE:CVE-2023-46805, CVE:CVE-2024-21887, CVE:CVE-2024-22024. Previous action: N/A. New action: Block. N/A","first_seen_at":"2026-11-02T21:00:16.759Z"}]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2024-03-12","firstIsNew":true,"daysToRule":60,"daysAtMost":null,"freePlan":false,"claims":[{"id":"03e80f292b23f6ec5903c2b17d21df7e4c6d7045f18a17f4b3f5e32d4c6662d0","cve_id":"CVE-2024-21887","vendor":"f5","product":"Attack signatures","rule_id":"200013080","rule_name":"Ivanti Pulse Connect Secure Authentication Bypass","change":"new","default_action":null,"published_on":"2024-03-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200013080 \"Ivanti Pulse Connect Secure Authentication Bypass\" (Authentication/Authorization Attacks, risk High), systems: Other Web Server. References: CVE-2023-46805, CVE-2024-21887.","first_seen_at":"2026-11-02T21:00:27.754Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:43.365Z","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2024-21887","templatePath":"http/cves/2024/CVE-2024-21887.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20oast.…","status":403,"blocked":true,"rules":["930100","930110"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2024-21887","templatePath":"http/cves/2024/CVE-2024-21887.yaml","requests":1,"blockedRequests":1,"rules":["930100","930110"],"note":"","requestDetail":[{"method":"GET","path":"/api/v1/totp/user-backup-code/../../license/keys-status/%3bcurl%20oast.…","status":403,"blocked":true,"rules":["930100","930110"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}