CVE-2021-22893

Katalog CVE

CVSS 10.0 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 47,2%

Kerentanan Improper Authentication pada ivanti connect secure. Skor CVSS 3.1 10.0 (Critical) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Rincian

Terbit di NVD

23 April 2021

Terakhir diubah

12 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-416: Use After Free

EPSS (30 hari)

47,2% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Ivanti Pulse Connect Secure Use-After-Free Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.pulsesecure.net/pulse-connect-secure-security-update/ advisory vendor
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44784/ broken link · advisory vendor
• https://kb.cert.org/vuls/id/213092 advisory pihak ketiga · pemerintah AS
• https://www.kb.cert.org/vuls/id/213092 pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-22893 pemerintah AS
• https://www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-sec... advisory pihak ketiga