Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2024-22024

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker t

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ivanti ICS

  • 9.1R14.5 to < 9.1R14.5affected
  • 9.1R17.3 to < 9.1R17.3affected
  • 9.1R18.4 to < 9.1R18.4affected
  • 22.1R6.1 to < 22.1R6.1affected
  • 9.1R14.4 to < 9.1R14.4unaffected
  • 9.1R15.2 to < 9.1R15.2unaffected
  • 9.1R16.2 to < 9.1R16.2unaffected
  • 9.1R17.2 to < 9.1R17.2unaffected
  • 9.1R18.3 to < 9.1R18.3unaffected
  • 22.1R6.1 to < 22.1R6.1unaffected
  • 22.2R4.1 to < 22.2R4.1affected
  • 22.3R1.1 to < 22.3R1.1affected
  • 22.4R1.1 to < 22.4R1.1affected
  • 22.5R1.2 to < 22.5R1.2affected
  • 22.6R1.1 to < 22.6R1.1affected
  • 22.4R2.3 to < 22.4R2.3affected
  • 22.5R2.3 to < 22.5R2.3affected
  • 22.6R2.2 to < 22.6R2.2affected
  • 22.2R4.1 to < 22.2R4.1unaffected
  • 22.3R1 to < 22.3R1unaffected
  • 22.4R1.1 to < 22.4R1.1unaffected
  • 22.5R1.1 to < 22.5R1.1unaffected
  • 22.6R1.1 to < 22.6R1.1unaffected
  • 22.4R2.2 to < 22.4R2.2unaffected
  • 22.5R2.2 to < 22.5R2.2unaffected
  • 22.6R2.2 to < 22.6R2.2unaffected

Ivant ICS

  • 9.1R15.3 to < 9.1R15.3affected

Ivanti IPS

  • 9.1R18.4 to < 9.1R18.4affected
  • 9.1R17.3 to < 9.1R17.3affected
  • 22.5R1.2 to < 22.5R1.2affected
  • 9.1R18.2 to < 9.1R18.2unaffected
  • 9.1R17.2 to < 9.1R17.2unaffected
  • 22.5R1.1 to < 22.5R1.1unaffected

References