CVE-2024-22023

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476 CWE-703

Affected software

Vendor	Product	Versions
Ivanti	Connect Secure	>= 22.1R6.2, < 22.1R6.2; >= 22.2R4.2, < 22.2R4.2; >= 22.3R1.2, < 22.3R1.2; >= 22.4R1.2, < 22.4R1.2; >= 22.4R2.4, < 22.4R2.4; >= 22.5R1.3, < 22.5R1.3; >= 22.5R2.4, < 22.5R2.4; >= 22.6R2.3, < 22.6R2.3; >= 9.1R14.6, < 9.1R14.6; >= 9.1R15.4, < 9.1R15.4; >= 9.1R16.4, < 9.1R16.4; >= 9.1R17.4, < 9.1R17.4; >= 9.1R18.5, < 9.1R18.5
Ivanti	Policy Secure	>= 22.4R1.2, < 22.4R1.2; >= 22.5R1.3, < 22.5R1.3; >= 22.6R1.2, < 22.6R1.2; >= 9.1R16.4, < 9.1R16.4; >= 9.1R17.4, < 9.1R17.4; >= 9.1R18.5, < 9.1R18.5
ivanti	connect_secure	9.1R18.5; 22.6R2.3; 9.1R17.4; 22.2R3; 22.5R2.4; 9.1R14.6; 9.1R15.4; 22.2R4.2; 22.4R1.2; 22.6R1.2; 22.1R6.2; 22.3R1.2; 22.4R2.4; 22.5R1.3
ivanti	policy_secure	22.4R1.2; 22.5R1.3; 22.6R1.2; 9.1R16.4; 9.1R17.4; 9.1R18.5

References

Timeline

Published: Apr 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220248.3An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and CVE-2024-220256.5A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet CVE-2024-220266.7A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execut CVE-2024-220276.5Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a CVE-2024-220284.6Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is no CVE-2024-220297.8Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root CVE-2024-22038.8The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via CVE-2024-220308.0A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack.CVE-2024-220318.5A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a pro CVE-2024-220326.5A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled.CVE-2024-220336.3The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to CVE-2024-220345.5Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configu