THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-22023

Reserved:2024-01-04
Published:2024-04-04
Updated:2024-06-10

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.



MEDIUM: 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Product status

Default status
unaffected

22.1R6.2 before 22.1R6.2
affected

22.2R4.2 before 22.2R4.2
affected

22.3R1.2 before 22.3R1.2
affected

22.4R1.2 before 22.4R1.2
affected

22.4R2.4 before 22.4R2.4
affected

22.5R1.3 before 22.5R1.3
affected

22.5R2.4 before 22.5R2.4
affected

22.6R2.3 before 22.6R2.3
affected

9.1R14.6 before 9.1R14.6
affected

9.1R15.4 before 9.1R15.4
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

Default status
unaffected

22.4R1.2 before 22.4R1.2
affected

22.5R1.3 before 22.5R1.3
affected

22.6R1.2 before 22.6R1.2
affected

9.1R16.4 before 9.1R16.4
affected

9.1R17.4 before 9.1R17.4
affected

9.1R18.5 before 9.1R18.5
affected

References

https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

cve.org CVE-2024-22023

nvd.nist.gov CVE-2024-22023

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-22023