VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Apr 4, 2024· Updated Jun 17, 2026

CVE-2024-22023

CVE-2024-22023

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Affected products

64
  • Ivanti/Connect Secure30 versions
    cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*+ 29 more
    • cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:22.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:22.5:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:lts:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
    • (no CPE)range: 9.x, 22.x
    • (no CPE)range: 22.1R6.2
  • Ivanti/Policy Secure34 versions
    cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*+ 33 more
    • cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:22.6:*:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: 22.4R1.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.