The vulnerability of Ivanti Connect Secure (previously known as Pulse Connect Secure), Ivanti Policy Secure, and Ivanti Neurons for Zero Trust Access (nZTA) – tools for authentication and access control – stems from incorrect restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information.

🗓️ 14 Feb 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Ivanti Connect Secure, Policy Secure, and Neurons Zero Trust Access have an XML link restriction flaw enabling unauthorized access.

Reporter	Title	Published	Views	Family All 143
0day.today	Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit	22 Jan 202400:00	–	zdt
0day.today	Ivanti Connect Secure Unauthenticated Remote Code Execution Exploit	21 Feb 202400:00	–	zdt
GithubExploit	Exploit for Command Injection in Ivanti Connect_Secure	20 Jan 202419:15	–	githubexploit
GithubExploit	Exploit for Improper Restriction of XML External Entity Reference in Ivanti Connect_Secure	9 Feb 202414:31	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Connect_Secure	16 Jan 202408:05	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Connect_Secure	18 Jan 202413:25	–	githubexploit
GithubExploit	Exploit for Command Injection in Ivanti Connect_Secure	3 Feb 202411:33	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Connect_Secure	14 Jan 202418:30	–	githubexploit
GithubExploit	Exploit for Command Injection in Ivanti Connect_Secure	14 Jan 202409:25	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Connect_Secure	14 Jan 202418:30	–	githubexploit

Vulners

Node

ivanti connect_secureMatch9.1r14.4

OR

ivanti connect_secureMatch9.1r17.2

OR

ivanti connect_secureMatch9.1r18.3

OR

ivanti connect_secureMatch22.4r2.2

OR

ivanti connect_secureMatch22.5r1.1

OR

ivanti policy_secureMatch22.5r1.1

OR

ivanti ivanti_neurons_for_zero_trust_access_(nzta)Match22.6r1.3

Source	Link
help	www.help.ivanti.com/ps/help/en_US/nSA/22.x/nsa-zta/gsg/pzta_gsg_oview.htm
forums	www.forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure
xakep	www.xakep.ru/2024/02/09/ivanti-cve-2024-22024/
forums	www.forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways
gist	www.gist.github.com/Hamid-K/f4288dae3a1f2dea8905b1cf16d59c1b
web	www.web.nvd.nist.gov/view/vuln/detail

17 Oct 2025 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 27.5

CVSS 38.3

EPSS0.99999

Ivanti Connect Secure Policy Secure Neurons Zero Trust XML Link Restriction Unauthorized Access