CVE-2024-22023

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Reserved 2024-01-04 | Published 2024-04-04 | Updated 2024-10-03 | Assigner hackerone

Product status

Default status
unaffected

22.1R6.2 before 22.1R6.2
affected

22.2R4.2 before 22.2R4.2
affected

22.3R1.2 before 22.3R1.2
affected

22.4R1.2 before 22.4R1.2
affected

22.4R2.4 before 22.4R2.4
affected

22.5R1.3 before 22.5R1.3
affected

22.5R2.4 before 22.5R2.4
affected

22.6R2.3 before 22.6R2.3
affected

9.1R14.6 before 9.1R14.6
affected

9.1R15.4 before 9.1R15.4
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

Default status
unaffected

22.4R1.2 before 22.4R1.2
affected

22.5R1.3 before 22.5R1.3
affected

22.6R1.2 before 22.6R1.2
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

References

forums.ivanti.com/...i-Policy-Secure-Gateways?language=en_US

cve.org (CVE-2024-22023)

nvd.nist.gov (CVE-2024-22023)

Download JSON