CVE-2024-22023

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-476CWE-703

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-220248.3An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) andCVE-2024-220256.5A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetCVE-2024-220266.7A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and executCVE-2024-220276.5Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a CVE-2024-220284.6Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. The user of the affected product is noCVE-2024-220297.8Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to rootCVE-2024-22038.8The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 viaCVE-2024-220308.0A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack.CVE-2024-220318.5A vulnerability has been identified within Rancher where a user with the ability to create a project, on a certain cluster, can create a proCVE-2024-220326.5A vulnerability has been identified in which an RKE1 cluster keeps constantly reconciling when secrets encryption configuration is enabled.CVE-2024-220336.3The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to CVE-2024-220345.5Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configu
CVE-2024-22023: Medium severity, CVSS 5.3 | Vulnix