Skip to content
fr Sign in
5.3 Medium

CVE-2024-22023 An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy…

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Affected products and versions

Product Affected versions Fixed in
Connect Secure 22.6 earliest → < 22.6R2.3 22.6R2.3
Connect Secure 22.5 earliest → < 22.5R2.4 22.5R1.3
Connect Secure 22.4 earliest → < 22.4R2.4 22.4R1.2
Connect Secure 22.3 earliest → < 22.3R1.2 22.3R1.2
Connect Secure 22.2 earliest → < 22.2R4.2 22.2R4.2
Connect Secure 22.1 earliest → < 22.1R6.2 22.1R6.2
Connect Secure 9.1 earliest → < 9.1R18.5 9.1R14.6
Policy Secure 22.6 earliest → < 22.6R1.2 22.6R1.2
Policy Secure 22.5 earliest → < 22.5R1.3 22.5R1.3
Show the 13 other branches
Product Affected versions Fixed in
Policy Secure 22.4 earliest → < 22.4R1.2 22.4R1.2
Policy Secure 9.1 earliest → < 9.1R18.5 9.1R16.4
connect_secure 22.6 22.6R1.2 → 22.6R2.3 No fix stated
connect_secure 22.5 22.5R1.3 → 22.5R2.4 No fix stated
connect_secure 22.4 22.4R1.2 → 22.4R2.4 No fix stated
connect_secure 22.3R1.2 No fix stated
connect_secure 22.2 22.2R3 → 22.2R4.2 No fix stated
connect_secure 22.1R6.2 No fix stated
connect_secure 9.1 9.1R14.6 → 9.1R18.5 No fix stated
policy_secure 22.6R1.2 No fix stated
policy_secure 22.5R1.3 No fix stated
policy_secure 22.4R1.2 No fix stated
policy_secure 9.1 9.1R16.4 → 9.1R18.5 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Connect Secure

The 65 CVEs of Connect Secure →
CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability 4.3 Medium CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability 7.0 High CVE-2026-104935 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability 8.6 High CVE-2025-55144 Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti… 5.4 Medium
Track this CVE