CVE-2024-29205

State: Published
Severity: 7.5 High
Published: Apr 24, 2024
Updated: Oct 3, 2024
Reserved: Mar 19, 2024

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	hackerone

Weaknesses

CWE-703 Improper Check or Handling of Exceptional Conditions

Affected Products

Product	Versions
Connect SecureIvanti	9.1R18.5 to before 9.1R18.5Affected 22.6R2.3 to before 22.6R2.3Affected 9.1R17.4 to before 9.1R17.4Affected 22.2R3 to before 22.2R3Affected 22.5R2.4 to before 22.5R2.4Affected 9.1R14.6 to before 9.1R14.6Affected 9.1R16.4 to before 9.1R16.4Affected 9.1R15.4 to before 9.1R15.4Affected 22.2R4.2 to before 22.2R4.2Affected 22.4R1.2 to before 22.4R1.2Affected 22.6R1.2 to before 22.6R1.2Affected 22.1R6.2 to before 22.1R6.2Affected 22.3R1.2 to before 22.3R1.2Affected
Connect SecureIvanti	22.4R2.4 to before 22.4R2.4Affected 22.5R1.3 to before 22.5R1.3Affected
Policy SecureIvanti	22.5R1.3 to before 22.5R1.3Affected 9.1R18.5 to before 9.1R18.5Affected 9.1R17.4 to before 9.1R17.4Affected 22.2R3 to before 22.2R3Affected

References

https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.