CVE-2024-22024

State: Published
Severity: 8.3 High
Published: Feb 13, 2024
Updated: May 9, 2025
Reserved: Jan 4, 2024

Description

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

Scores

CVSS	Score	Vector	Source
3.0	8.3 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L	hackerone

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
ICSIvanti	9.1R14.5 to before 9.1R14.5Affected 9.1R17.3 to before 9.1R17.3Affected 9.1R18.4 to before 9.1R18.4Affected 22.1R6.1 to before 22.1R6.1Affected 9.1R14.4 to before 9.1R14.4Not affected 9.1R15.2 to before 9.1R15.2Not affected 9.1R16.2 to before 9.1R16.2Not affected 9.1R17.2 to before 9.1R17.2Not affected 9.1R18.3 to before 9.1R18.3Not affected 22.1R6.1 to before 22.1R6.1Not affected 22.2R4.1 to before 22.2R4.1Affected 22.3R1.1 to before 22.3R1.1Affected 22.4R1.1 to before 22.4R1.1Affected 22.5R1.2 to before 22.5R1.2Affected 22.6R1.1 to before 22.6R1.1Affected 22.4R2.3 to before 22.4R2.3Affected 22.5R2.3 to before 22.5R2.3Affected 22.6R2.2 to before 22.6R2.2Affected 22.2R4.1 to before 22.2R4.1Not affected 22.3R1 to before 22.3R1Not affected 22.4R1.1 to before 22.4R1.1Not affected 22.5R1.1 to before 22.5R1.1Not affected 22.6R1.1 to before 22.6R1.1Not affected 22.4R2.2 to before 22.4R2.2Not affected 22.5R2.2 to before 22.5R2.2Not affected and 1 more version
ICSIvant	9.1R15.3 to before 9.1R15.3Affected
IPSIvanti	9.1R18.4 to before 9.1R18.4Affected 9.1R17.3 to before 9.1R17.3Affected 22.5R1.2 to before 22.5R1.2Affected 9.1R18.2 to before 9.1R18.2Not affected 9.1R17.2 to before 9.1R17.2Not affected 22.5R1.1 to before 22.5R1.1Not affected

References

https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.