Unrated severityNVD Advisory· Published Feb 13, 2024· Updated May 9, 2025

CVE-2024-22024

Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Affected products

Ivanti/Connect Securellm-fuzzy
Range: 9.x, 22.x
Ivanti/Policy Securellm-fuzzy
Range: 9.x, 22.x
Ivant/ICSv5
Range: 9.1R15.3
Ivanti/ICSv5
Range: 9.1R14.5
Ivanti/IPSv5
Range: 9.1R18.4

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Securemitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.076
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000