Skip to content
fr Sign in
8.3 High

CVE-2024-22024 An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…

Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Affected products and versions

Product Affected versions Fixed in
ICS 22.6 earliest → < 22.6R2.2 22.6R1.1
ICS 22.5 earliest → < 22.5R2.3 22.5R1.2
ICS 22.4 earliest → < 22.4R2.3 22.4R1.1
ICS 22.3 earliest → < 22.3R1.1 22.3R1.1
ICS 22.2 earliest → < 22.2R4.1 22.2R4.1
ICS 22.1 earliest → < 22.1R6.1 22.1R6.1
ICS 9.1 earliest → < 9.1R18.4 9.1R14.5
ICS 9.1 earliest → < 9.1R15.3 9.1R15.3
IPS 22.5 earliest → < 22.5R1.2 22.5R1.2
Show the other branch
Product Affected versions Fixed in
IPS 9.1 earliest → < 9.1R18.4 9.1R18.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of ICS

The 5 CVEs of ICS →
CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability 8.2 High CVE-2024-21888 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure… 8.8 High CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability 8.2 High CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability 9.1 Critical
Track this CVE