UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22023

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

Severity
Medium 5.3
Published
4 Apr 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • Version 22.6
  • Version 22.5
  • Version 22.4
  • Version 22.3
All 28 release lines
  • Version 9.1-r1
  • Version 9.1-r2
  • Version 9.1-r3
  • Version 9.1-r4
  • Version 9.1-r4.1
  • Version 9.1-r4.2
  • Version 9.1-r4.3
  • Version 9.1-r5
  • Version 9.1-r6
  • Version 9.1-r7
  • Version 9.1-r8
  • Version 9.1-r9
  • Version 9.1-r10
  • Version 9.1-r11
  • Version 9.1-r11.5
  • Version 9.1-r12
  • Version 9.1-r13
  • Version 9.1-r14
  • Version 9.1-r15
  • Version 9.1-r16
  • Version 9.1-r17
  • Version 9.1-r18
  • Version 22.1
  • Version 22.2
  • Version 22.3
  • Version 22.4
  • Version 22.5
  • Version 22.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22023
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22023