Lucene search

K
vulnrichmentHackeroneVULNRICHMENT:CVE-2024-22023
HistoryApr 04, 2024 - 7:45 p.m.

CVE-2024-22023

2024-04-0419:45:10
hackerone
github.com
1
cve-2024-22023
saml component
ivanti connect secure
ivanti policy secure
unauthenticated attacker
xml requests
resource exhaustion
dos

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.

CNA Affected

[
  {
    "vendor": "Ivanti",
    "product": "Connect Secure",
    "versions": [
      {
        "status": "affected",
        "version": "22.1R6.2",
        "lessThan": "22.1R6.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2R4.2",
        "lessThan": "22.2R4.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3R1.2",
        "lessThan": "22.3R1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.4R1.2",
        "lessThan": "22.4R1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.4R2.4",
        "lessThan": "22.4R2.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.5R1.3",
        "lessThan": "22.5R1.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.5R2.4",
        "lessThan": "22.5R2.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.6R2.3",
        "lessThan": "22.6R2.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R14.6",
        "lessThan": "9.1R14.6",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R15.4",
        "lessThan": "9.1R15.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R16.4",
        "lessThan": "9.1R16.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R17.4",
        "lessThan": "9.1R17.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R18.5",
        "lessThan": "9.1R18.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Ivanti",
    "product": "Policy Secure",
    "versions": [
      {
        "status": "affected",
        "version": "22.4R1.2",
        "lessThan": "22.4R1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.5R1.3",
        "lessThan": "22.5R1.3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.6R1.2",
        "lessThan": "22.6R1.2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R16.4",
        "lessThan": "9.1R16.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R17.4",
        "lessThan": "9.1R17.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "9.1R18.5",
        "lessThan": "9.1R18.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

7 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

Related for VULNRICHMENT:CVE-2024-22023