CVE-2024-22024: XEE
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-22024?
CVE-2024-22024 is considered a high-severity vulnerability due to its potential for unauthorized access to restricted resources.
How do I fix CVE-2024-22024?
To fix CVE-2024-22024, update your Ivanti Connect Secure or Policy Secure systems to the latest patched versions provided by Ivanti.
Which Ivanti products are affected by CVE-2024-22024?
CVE-2024-22024 affects Ivanti Connect Secure versions 9.x and 22.x, Ivanti Policy Secure versions 9.x and 22.x, and ZTA gateways.
What type of attack does CVE-2024-22024 facilitate?
CVE-2024-22024 facilitates XML external entity (XXE) attacks, allowing attackers to access sensitive resources without authentication.
Is CVE-2024-22024 actively being exploited?
Yes, CVE-2024-22024 has been reported as actively exploited in the wild, making patching and mitigation urgent.