Lucene search

[email protected]CVE-2024-22023

HistoryApr 04, 2024 - 8:15 p.m.

CVE-2024-22023

2024-04-0420:15:08

CWE-476

[email protected]

web.nvd.nist.gov

xml entity expansion

ivanti connect secure

ivanti policy secure

resource exhaustion

dos

saml component

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

16.6%

JSON

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

CPENameOperatorVersion
ivanti:connect_secureivanti connect secureeq9.1
ivanti:connect_secureivanti connect secureeq22.1
ivanti:connect_secureivanti connect secureeq22.2
ivanti:connect_secureivanti connect secureeq22.3
ivanti:connect_secureivanti connect secureeq22.4
ivanti:connect_secureivanti connect secureeq22.5
ivanti:connect_secureivanti connect secureeq22.6
ivanti:policy_secureivanti policy secureeq9.0
ivanti:policy_secureivanti policy secureeq9.1
ivanti:policy_secureivanti policy secureeq22.1

CPE	Name	Operator	Version
ivanti:connect_secure	ivanti connect secure	eq	9.1
ivanti:connect_secure	ivanti connect secure	eq	22.1
ivanti:connect_secure	ivanti connect secure	eq	22.2
ivanti:connect_secure	ivanti connect secure	eq	22.3
ivanti:connect_secure	ivanti connect secure	eq	22.4
ivanti:connect_secure	ivanti connect secure	eq	22.5
ivanti:connect_secure	ivanti connect secure	eq	22.6
ivanti:policy_secure	ivanti policy secure	eq	9.0
ivanti:policy_secure	ivanti policy secure	eq	9.1
ivanti:policy_secure	ivanti policy secure	eq	22.1

Rows per page:

1-10 of 151

References

forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Social References

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7.4 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

16.6%

JSON

Related for CVE-2024-22023

cvelist1 nessus2 thn1