CVE-2024-22024highobserved exploitationCWE-611

CVE-2024-22024: high-severity vulnerability in Ivant ICS

Published · Updated

Follow this CVE+ Monitor ICS+ Monitor IPS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 8.3epss 95%
from disclosure to weaponsame day
Published on NVDFeb 13
1st PoCFeb 9
VulnCheckFeb 6
In short

A flaw in the SAML component allows attackers to read restricted files and resources on Ivanti Connect Secure, Policy Secure, and ZTA gateways without needing to log in. This happens because the system doesn't properly validate XML data, letting attackers inject external entity references.

Technical detail

An XXE (XML External Entity) vulnerability in the SAML processing logic of Ivanti Connect Secure and Policy Secure (versions 9.x, 22.x) and ZTA gateways permits unauthenticated attackers to access restricted resources. The vulnerability stems from insufficient validation of XML input, enabling entity expansion attacks to bypass access controls and retrieve sensitive data.

Summary generated and translated by AI from the official description.
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected products
Ivant · ICSIvanti · ICSIvanti · IPS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivant ICS

In the same product, most dangerous first.

CVE-2024-21893HIGHCVE-2024-21893EPSS 100.0%KEVCVE-2024-21887CRITICALCVE-2024-21887EPSS 100.0%KEVCVE-2023-46805HIGHCVE-2023-46805EPSS 100.0%KEVCVE-2024-21888HIGHCVE-2024-21888EPSS 85.4%