CVE-2021-22899 — Ivanti Pulse Connect Secure Command Injection Vulnerability

provenance: imported · CVE: CVE-2021-22899

CVE-2021-22899: Ivanti Pulse Connect Secure Command Injection Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Ivanti
Product	Pulse Connect Secure
Date added	2021-11-03
Due date	2022-05-03
Ransomware campaign use	Unknown

Description

Ivanti Pulse Connect Secure contains a command injection vulnerability that allows remote authenticated users to perform remote code execution via Windows File Resource Profiles.

Required action (CISA)

Apply updates per vendor instructions.

Notes

Reference CISA's ED 21-03 (https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 21-03. https://nvd.nist.gov/vuln/detail/CVE-2021-22899

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-22899
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

concept/cve-anatomy