The vulnerability of the SAML components in Ivanti Connect Secure and Ivanti Policy Secure network access control tools allows a perpetrator to trigger a service failure.

🗓️ 19 Apr 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

SAML components in Ivanti Connect Secure and Ivanti Policy Secure cause disruption via aliasing.

Reporter	Title	Published	Views	Family All 52
BDU FSTEC	The vulnerability of the IPSec components of Ivanti Connect Secure and Ivanti Policy Secure network access control tools allows a perpetrator to trigger a service failure or execute arbitrary code.	4 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the IPSec components of Ivanti Connect Secure and Ivanti Policy Secure network access control tools allows a hacker to trigger a service failure.	19 Apr 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the IPSec components of Ivanti Connect Secure and Ivanti Policy Secure network access control tools allows a hacker to trigger a service failure.	19 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-21894	4 Apr 202407:03	–	circl
Circl	CVE-2024-22023	4 Apr 202411:29	–	circl
Circl	CVE-2024-22052	4 Apr 202411:29	–	circl
Circl	CVE-2024-22053	4 Apr 202411:29	–	circl
CISA	Ivanti Releases Security Update for Ivanti Connect Secure and Policy Secure Gateways	4 Apr 202412:00	–	cisa
CNNVD	Ivanti Connect Secure和Ivanti Policy Secure 安全漏洞	25 Apr 202400:00	–	cnnvd
CNNVD	Ivanti Connect Secure和Ivanti Policy Secure 缓冲区错误漏洞	4 Apr 202400:00	–	cnnvd

Vulners

Node

ivanti policy_secureMatch9.0

OR

ivanti connect_secureRange22.1–22.6

OR

ivanti policy_secureMatch9.1

OR

ivanti policy_secureRange22.1–22.6

Source	Link
forums	www.forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways
web	www.web.nvd.nist.gov/view/vuln/detail

19 Apr 2024 00:00Current

6.9Medium risk

Vulners AI Score6.9

CVSS 25

CVSS 35.3

EPSS0.07942

Ivanti Connect Secure Ivanti Policy Secure Assertion Markup Language Remote disruption Pointer aliasing error