CVE-2024-22023 | THREATINT

Assigner	hackerone
Reserved	2024-01-04
Published	2024-04-04
Updated	2024-06-20

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

MEDIUM: 5.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Product status

Default status

unaffected

22.1R6.2 before 22.1R6.2

affected

22.2R4.2 before 22.2R4.2

affected

22.3R1.2 before 22.3R1.2

affected

22.4R1.2 before 22.4R1.2

affected

22.4R2.4 before 22.4R2.4

affected

22.5R1.3 before 22.5R1.3

affected

22.5R2.4 before 22.5R2.4

affected

22.6R2.3 before 22.6R2.3

affected

9.1R14.6 before 9.1R14.6

affected

9.1R15.4 before 9.1R15.4

affected

9.1R16.4 before 9.1R16.4

affected

9.1R17.4 before 9.1R17.4

affected

9.1R18.5 before 9.1R18.5

affected

Default status

unaffected

22.4R1.2 before 22.4R1.2

affected

22.5R1.3 before 22.5R1.3

affected

22.6R1.2 before 22.6R1.2

affected

9.1R16.4 before 9.1R16.4

affected

9.1R17.4 before 9.1R17.4

affected

9.1R18.5 before 9.1R18.5

affected

References

https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

cve.org CVE-2024-22023

nvd.nist.gov CVE-2024-22023

Download JSON