CVE-2024-22023
04.04.2024, 20:15
An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.Enginsight
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect_secure | 9.1:r1 |
| ivanti | connect_secure | 9.1:r10 |
| ivanti | connect_secure | 9.1:r11 |
| ivanti | connect_secure | 9.1:r11.5 |
| ivanti | connect_secure | 9.1:r12 |
| ivanti | connect_secure | 9.1:r13 |
| ivanti | connect_secure | 9.1:r14 |
| ivanti | connect_secure | 9.1:r15 |
| ivanti | connect_secure | 9.1:r16 |
| ivanti | connect_secure | 9.1:r17 |
| ivanti | connect_secure | 9.1:r18 |
| ivanti | connect_secure | 9.1:r2 |
| ivanti | connect_secure | 9.1:r3 |
| ivanti | connect_secure | 9.1:r4 |
| ivanti | connect_secure | 9.1:r4.1 |
| ivanti | connect_secure | 9.1:r4.2 |
| ivanti | connect_secure | 9.1:r4.3 |
| ivanti | connect_secure | 9.1:r5 |
| ivanti | connect_secure | 9.1:r6 |
| ivanti | connect_secure | 9.1:r7 |
| ivanti | connect_secure | 9.1:r8 |
| ivanti | connect_secure | 9.1:r9 |
| ivanti | connect_secure | 22.1 |
| ivanti | connect_secure | 22.2 |
| ivanti | connect_secure | 22.3 |
| ivanti | connect_secure | 22.4 |
| ivanti | connect_secure | 22.5 |
| ivanti | connect_secure | 22.6 |
| ivanti | policy_secure | 9.0 |
| ivanti | policy_secure | 9.0:r1 |
| ivanti | policy_secure | 9.0:r2 |
| ivanti | policy_secure | 9.0:r2.1 |
| ivanti | policy_secure | 9.0:r3 |
| ivanti | policy_secure | 9.0:r3.1 |
| ivanti | policy_secure | 9.0:r4 |
| ivanti | policy_secure | 9.1 |
| ivanti | policy_secure | 9.1:r1 |
| ivanti | policy_secure | 9.1:r10 |
| ivanti | policy_secure | 9.1:r11 |
| ivanti | policy_secure | 9.1:r12 |
| ivanti | policy_secure | 9.1:r13 |
| ivanti | policy_secure | 9.1:r14 |
| ivanti | policy_secure | 9.1:r15 |
| ivanti | policy_secure | 9.1:r16 |
| ivanti | policy_secure | 9.1:r17 |
| ivanti | policy_secure | 9.1:r18 |
| ivanti | policy_secure | 9.1:r2 |
| ivanti | policy_secure | 9.1:r3 |
| ivanti | policy_secure | 9.1:r4 |
| ivanti | policy_secure | 9.1:r5 |
| ivanti | policy_secure | 9.1:r6 |
| ivanti | policy_secure | 9.1:r7 |
| ivanti | policy_secure | 9.1:r8 |
| ivanti | policy_secure | 9.1:r9 |
| ivanti | policy_secure | 22.1 |
| ivanti | policy_secure | 22.2 |
| ivanti | policy_secure | 22.3 |
| ivanti | policy_secure | 22.4 |
| ivanti | policy_secure | 22.5 |
| ivanti | policy_secure | 22.6 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-476 - NULL Pointer DereferenceA NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
- CWE-703 - Improper Check or Handling of Exceptional ConditionsThe software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
References