CVE-2024-22024
Published: 13 February 2024
Summary
CVE-2024-22024 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Ivanti Connect Secure. Its CVSS base score is 8.3 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-22024 is an XML external entity vulnerability, tracked under CWE-611, that affects the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x), and ZTA gateways. The flaw carries a CVSS 3.1 score of 8.3 and enables access to certain restricted resources without requiring authentication.
An unauthenticated attacker can exploit the issue remotely over the network to reach protected resources that would otherwise be inaccessible. The EPSS score for the CVE is currently 0.9425, matching its recorded peak.
Ivanti has published advisory information on the vulnerability through its support forums. No details on real-world exploitation or additional context are available in the provided data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-19630
Vulnerability details
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.