VulnerabilityModified
CVE-2024-22024
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
HIGH 8.3EPSS 94.7%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 94.7%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.
- CVSS 3.1
- 8.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- EPSS
- 94.72% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- ivanti/connect secure · ivanti/policy secure · ivanti/zero trust access gateway
- Source
- support@hackerone.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.