CVE-2021-22894: Ivanti Pulse Connect Secure Collaboration Suite Buffer Overflow Vulnerability
Published May 27, 2021
·Updated
Ivanti Pulse Connect Secure Collaboration Suite contains a buffer overflow vulnerabilities that allows a remote authenticated users to execute code as the root user via maliciously crafted meeting room.
Other sources
A buffer overflow vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to execute arbitrary code as the root user via maliciously crafted meeting room.
— NVD
Affected Software
82 affected components
Ivanti Connect Secure=9.0
Ivanti Connect Secure=9.0-r1
Ivanti Connect Secure=9.0-r1.0
Ivanti Connect Secure=9.0-r2
Ivanti Connect Secure=9.0-r2.0
Ivanti Connect Secure=9.0-r2.1
Ivanti Connect Secure=9.0-r3
Ivanti Connect Secure=9.0-r3.0
Ivanti Connect Secure=9.0-r3.1
Ivanti Connect Secure=9.0-r3.2
Ivanti Connect Secure=9.0-r3.3
Ivanti Connect Secure=9.0-r3.5
Ivanti Connect Secure=9.0-r4
Ivanti Connect Secure=9.0-r4.0
Ivanti Connect Secure=9.0-r4.1
Ivanti Connect Secure=9.0-r5.0
Ivanti Connect Secure=9.0-r6.0
Ivanti Connect Secure=9.1
Ivanti Connect Secure=9.1-r1
Ivanti Connect Secure=9.1-r10.0
Ivanti Connect Secure=9.1-r10.2
Ivanti Connect Secure=9.1-r11.0
Ivanti Connect Secure=9.1-r11.1
Ivanti Connect Secure=9.1-r11.3
Ivanti Connect Secure=9.1-r2
Ivanti Connect Secure=9.1-r3
Ivanti Connect Secure=9.1-r4
Ivanti Connect Secure=9.1-r4.1
Ivanti Connect Secure=9.1-r4.2
Ivanti Connect Secure=9.1-r4.3
Ivanti Connect Secure=9.1-r5
Ivanti Connect Secure=9.1-r6
Ivanti Connect Secure=9.1-r7
Ivanti Connect Secure=9.1-r8
Ivanti Connect Secure=9.1-r8.1
Ivanti Connect Secure=9.1-r8.2
Ivanti Connect Secure=9.1-r8.4
Ivanti Connect Secure=9.1-r9
Ivanti Connect Secure=9.1-r9.1
Ivanti Connect Secure=9.1-r9.2
PulseSecure Pulse Connect Secure<=9.1
PulseSecure Pulse Connect Secure=9.0
PulseSecure Pulse Connect Secure=9.0-r1
PulseSecure Pulse Connect Secure=9.0-r1.0
PulseSecure Pulse Connect Secure=9.0-r2
PulseSecure Pulse Connect Secure=9.0-r2.0
PulseSecure Pulse Connect Secure=9.0-r2.1
PulseSecure Pulse Connect Secure=9.0-r3
PulseSecure Pulse Connect Secure=9.0-r3.0
PulseSecure Pulse Connect Secure=9.0-r3.1
PulseSecure Pulse Connect Secure=9.0-r3.2
PulseSecure Pulse Connect Secure=9.0-r3.3
PulseSecure Pulse Connect Secure=9.0-r3.5
PulseSecure Pulse Connect Secure=9.0-r4
PulseSecure Pulse Connect Secure=9.0-r4.0
PulseSecure Pulse Connect Secure=9.0-r4.1
PulseSecure Pulse Connect Secure=9.0-r5.0
PulseSecure Pulse Connect Secure=9.0-r6.0
PulseSecure Pulse Connect Secure=9.1
PulseSecure Pulse Connect Secure=9.1-r1
PulseSecure Pulse Connect Secure=9.1-r10.0
PulseSecure Pulse Connect Secure=9.1-r10.2
PulseSecure Pulse Connect Secure=9.1-r11.0
PulseSecure Pulse Connect Secure=9.1-r11.1
PulseSecure Pulse Connect Secure=9.1-r11.3
PulseSecure Pulse Connect Secure=9.1-r2
PulseSecure Pulse Connect Secure=9.1-r3
PulseSecure Pulse Connect Secure=9.1-r4
PulseSecure Pulse Connect Secure=9.1-r4.1
PulseSecure Pulse Connect Secure=9.1-r4.2
PulseSecure Pulse Connect Secure=9.1-r4.3
PulseSecure Pulse Connect Secure=9.1-r5
PulseSecure Pulse Connect Secure=9.1-r6
PulseSecure Pulse Connect Secure=9.1-r7
PulseSecure Pulse Connect Secure=9.1-r8
PulseSecure Pulse Connect Secure=9.1-r8.1
PulseSecure Pulse Connect Secure=9.1-r8.2
PulseSecure Pulse Connect Secure=9.1-r8.4
PulseSecure Pulse Connect Secure=9.1-r9
PulseSecure Pulse Connect Secure=9.1-r9.1
PulseSecure Pulse Connect Secure=9.1-r9.2
Ivanti Pulse Connect Secure
Event History
May 27, 2021
CVE Published
via MITRE·11:15 AM
Data Sourced
via MITRE·11:15 AM
DescriptionWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 3, 2021
Known Exploited
via CISA·12:00 AM
Frequently Asked Questions
1
What is CVE-2021-22894?
CVE-2021-22894 is a buffer overflow vulnerability in Ivanti Pulse Connect Secure Collaboration Suite.
2
Who is affected by CVE-2021-22894?
Users of Ivanti Pulse Connect Secure Collaboration Suite are affected by CVE-2021-22894.
3
How does CVE-2021-22894 affect users?
CVE-2021-22894 allows remote authenticated users to execute code as the root user.
4
What is the severity of CVE-2021-22894?
The severity of CVE-2021-22894 is not specified.
5
How can I fix CVE-2021-22894?
To fix CVE-2021-22894, it is recommended to apply the necessary security patches provided by Ivanti.