Infiltrating Defenses: Abusing VMware in MITRE’s Cyber Intrusion
ctid.mitre.org · 22 May 2024 · Licence: not cleared; local research copy only
CVEs this report names
2 CVEs- CVE-2024-21887Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityIvanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+2 more · 4 reports>99.9%Top 0.01%88.4priority
- CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityIvanti · Connect Secure and Policy SecureKEVRansomwarePublic exploitHigh · 8.2T1190Exploit Public-Facing ApplicationT1078Valid Accounts+2 more · 4 reports>99.9%Top 0.02%87.7priority
Where it names them
CVE-2024-21887 Original (opens in a new tab) ↗
Adversary compromised MITRE’s prototypingnetwork through a pair of zero-day vulnerabilities in Ivanti Connect Secure (CVE-2023–46805 & CVE-2024–21887)
CVE-2023-46805 Original (opens in a new tab) ↗
Adversary compromised MITRE’s prototypingnetwork through a pair of zero-day vulnerabilities in Ivanti Connect Secure (CVE-2023–46805 & CVE-2024–21887)
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.