We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-22023



Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Reserved 2024-01-04 | Published 2024-04-04 | Updated 2024-10-03 | Assigner hackerone


MEDIUM: 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Product status

Default status
unaffected

22.1R6.2 before 22.1R6.2
affected

22.2R4.2 before 22.2R4.2
affected

22.3R1.2 before 22.3R1.2
affected

22.4R1.2 before 22.4R1.2
affected

22.4R2.4 before 22.4R2.4
affected

22.5R1.3 before 22.5R1.3
affected

22.5R2.4 before 22.5R2.4
affected

22.6R2.3 before 22.6R2.3
affected

9.1R14.6 before 9.1R14.6
affected

9.1R15.4 before 9.1R15.4
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

Default status
unaffected

22.4R1.2 before 22.4R1.2
affected

22.5R1.3 before 22.5R1.3
affected

22.6R1.2 before 22.6R1.2
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

References

forums.ivanti.com/...i-Policy-Secure-Gateways?language=en_US

cve.org (CVE-2024-22023)

nvd.nist.gov (CVE-2024-22023)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-22023

Support options

Helpdesk Chat, Email, Knowledgebase