Unrated severityNVD Advisory· Published Apr 4, 2024· Updated Oct 3, 2024

CVE-2024-22023

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Affected products

Ivanti/Connect Securellm-fuzzy2 versions
9.x, 22.x+ 1 more
- (no CPE)range: 9.x, 22.x
- (no CPE)range: 22.1R6.2
Ivanti/Policy Securellm-fuzzy2 versions
9.x, 22.x (implied same as Connect Secure)+ 1 more
- (no CPE)range: 9.x, 22.x (implied same as Connect Secure)
- (no CPE)range: 22.4R1.2

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gatewaysmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000