Lucene search

AttackerKBAKB:6C5EBC66-5F3C-4B4B-8986-07B2301785F5

HistoryFeb 13, 2024 - 12:00 a.m.

CVE-2024-22024

2024-02-1300:00:00

attackerkb.com

vulnerability

xxe

saml component

ivanti

unauthorized access

http

post request

base64 decoded

abused

attacker value

8.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.006 Low

EPSS

Percentile

77.8%

JSON

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Recent assessments:

cbeek-r7 at February 09, 2024 3:26pm UTC reported:

An HTTP POST request towards /dana-na/auth/saml-sso.cgi using the SAMLRequest as the vehicle with a base64 decoded XXE payload works and is already observed being abused in the wild.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 5