← CVE Intelligence

CVE-2024-22023

Ivanti / Connect Secure PUBLISHED

Description (CNA)

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Affected (CNA)

Vendor / productVersions
Ivanti / Connect Secureaffected 22.1R6.2 before 22.1R6.2; affected 22.2R4.2 before 22.2R4.2; affected 22.3R1.2 before 22.3R1.2; affected 22.4R1.2 before 22.4R1.2; affected 22.4R2.4 before 22.4R2.4; affected 22.5R1.3 before 22.5R1.3; affected 22.5R2.4 before 22.5R2.4; affected 22.6R2.3 before 22.6R2.3; affected 9.1R14.6 before 9.1R14.6; affected 9.1R15.4 before 9.1R15.4; affected 9.1R16.4 before 9.1R16.4; affected 9.1R17.4 before 9.1R17.4; affected 9.1R18.5 before 9.1R18.5
Ivanti / Policy Secureaffected 22.4R1.2 before 22.4R1.2; affected 22.5R1.3 before 22.5R1.3; affected 22.6R1.2 before 22.6R1.2; affected 9.1R16.4 before 9.1R16.4; affected 9.1R17.4 before 9.1R17.4; affected 9.1R18.5 before 9.1R18.5

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.