{"id":901,"date":"2024-03-01T14:51:02","date_gmt":"2024-03-01T14:51:02","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/five-eyes-upozorava-na-aktivno-iskoristavanje-ranjivosti-ivanti-gatewaya\/"},"modified":"2026-11-04T08:52:54","modified_gmt":"2026-11-04T08:52:54","slug":"five-eyes-upozorava-na-aktivno-iskoristavanje-ranjivosti-ivanti-gatewaya","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/five-eyes-upozorava-na-aktivno-iskoristavanje-ranjivosti-ivanti-gatewaya\/","title":{"rendered":"Five Eyes upozorava na aktivno iskori\u0161tavanje ranjivosti Ivanti gatewaya"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/thehackernews.com\/2024\/03\/five-eyes-agencies-warn-of-active.html\">The Hacker News<\/a> prenosi kako obavje\u0161tajni savez \"Pet o\u010diju\"<\/strong> (Five Eyes), koji \u010dine Sjedinjene Ameri\u010dke Dr\u017eave, Velika Britanija, Kanada, Australija i Novi Zeland <a href=\"https:\/\/thehackernews.com\/2024\/03\/five-eyes-agencies-warn-of-active.html\">upozorava na iskori\u0161tavanje ranjivosti Ivanti poveznika (<em>engl. gatewaya<\/em>)<\/a> te da Ivantijev Integrity Checker Tool (ICT) nije dovoljna za\u0161tita jer ne skenira sve direktorije i na taj na\u010din ostavlja napada\u010dima mogu\u0107nost postavljanja stra\u017enjih ulaza (<em>engl. backdoor<\/em>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mandiant je objavio kako kriptirana verzija BUSHWALK malvera mo\u017ee biti postavljena u direktorij koji ICT ne skenira i tako izbje\u0107i detekciju.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ivanti je od po\u010detka godine objavio pet ranjivosti svojih proizvoda od kojih su \u010dak \u010detiri iskori\u0161tene za napade.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Napomena:<\/strong> ne radi se o novim ranjivostima i <a href=\"https:\/\/www.ivanti.com\/blog\/enhanced-external-integrity-checking-tool-to-provide-additional-visibility-and-protection-for-customers-against-evolving-threat-actor-techniques-in-relation-to-previously-disclosed-vulnerabilities\">Ivanti<\/a> nije primijetio uspje\u0161nu kompromitaciju i ustrajno zadr\u017eavanje napada\u010da u sustavima nakon tvorni\u010dkog reseta i sigurnosnih a\u017euriranja.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ivanti ranjivosti:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2023-46805\">CVE-2023-46805<\/a> (CVSS 8.2) - Authentication bypass vulnerability in web component<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2024-21887\">CVE-2024-21887<\/a> (CVSS 9.1) - Command injection vulnerability in web component<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2024-21888\">CVE-2024-21888<\/a> (CVSS 8.8) - Privilege escalation vulnerability in web component<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2024-21893\">CVE-2024-21893<\/a> (CVSS 8.2) - SSRF vulnerability in the SAML component<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2024-22024\">CVE-2024-22024<\/a> (CVSS 8.3) - XXE vulnerability in the SAML component<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Savjetuje se preuzimanje i pokretanje a\u017euriranog ICT-a kojeg je Ivanti izdao 27. velja\u010de.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>CISA je izdala <a href=\"https:\/\/www.cisa.gov\/news-events\/cybersecurity-advisories\/aa24-060b\">sigurnosne savjete<\/a> vezane uz ovu opasnost, a dodatne informacije mo\u017eete prona\u0107i na <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2024\/02\/29\/cisa-and-partners-release-advisory-threat-actors-exploiting-ivanti-connect-secure-and-policy-secure\">cisa.gov<\/a>.<\/strong><\/p>","protected":false},"excerpt":{"rendered":"<p>The Hacker News prenosi kako obavje\u0161tajni savez &#8220;Pet o\u010diju&#8221; (Five Eyes), koji \u010dine Sjedinjene Ameri\u010dke Dr\u017eave, Velika Britanija, Kanada, Australija i Novi Zeland upozorava na iskori\u0161tavanje ranjivosti Ivanti poveznika (engl. gatewaya) te da Ivantijev Integrity Checker Tool (ICT) nije dovoljna za\u0161tita jer ne skenira sve direktorije i na taj na\u010din ostavlja napada\u010dima mogu\u0107nost postavljanja stra\u017enjih [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1361,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-901","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/901","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=901"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/901\/revisions"}],"predecessor-version":[{"id":1367,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/901\/revisions\/1367"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1361"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=901"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=901"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=901"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=901"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=901"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}