{"id":"CVE-2024-22024","published":"2024-02-13T04:07:04Z","modified":"2025-05-09T18:26:09Z","title":"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…","vendor":"Ivanti","product":"ICS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"ICS","versions":[">= 9.1R14.5, < 9.1R14.5",">= 9.1R17.3, < 9.1R17.3",">= 9.1R18.4, < 9.1R18.4",">= 22.1R6.1, < 22.1R6.1",">= 22.2R4.1, < 22.2R4.1",">= 22.3R1.1, < 22.3R1.1",">= 22.4R1.1, < 22.4R1.1",">= 22.5R1.2, < 22.5R1.2",">= 22.6R1.1, < 22.6R1.1",">= 22.4R2.3, < 22.4R2.3"]},{"vendor":"Ivant ","product":"ICS","versions":[">= 9.1R15.3, < 9.1R15.3"]},{"vendor":"Ivanti","product":"IPS","versions":[">= 9.1R18.4, < 9.1R18.4",">= 9.1R17.3, < 9.1R17.3",">= 22.5R1.2, < 22.5R1.2"]}],"description":{"text":"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.","provenance":"source","from":"CVE.org"},"summary":{"text":"An XML external entity (XXE) vulnerability exists in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. An unauthenticated attacker over the network, requiring no user interaction, can access certain restricted resources through the flaw.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:45Z"},"cvss":{"score":8.3,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.94721,"percentile":0.99858,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-02-06","exploitedFirstSeen":"2024-02-06","ransomware":false,"evidence":[{"url":"https://www.wiz.io/blog/ivanti-vulnerabilities-cve-2023-46805-cve-2024-21887-cve-2024-21888-and-cve-2024-21893","date":"2024-02-06"},{"url":"https://attackerkb.com/assessments/e3572615-0a93-4e5b-a181-432316d5c6d3","date":"2024-02-09"},{"url":"https://twitter.com/collysucker/status/1755912922516087208","date":"2024-02-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-10&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-11&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-12&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-13&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-14&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-14"},{"url":"https://www.akamai.com/blog/security-research/scanning-activity-ivanti-cve-february-2024","date":"2024-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-15&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-15"}],"evidenceTotal":552,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19630","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19630","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-02-09","earliestUrl":"https://github.com/0dteam/CVE-2024-22024","repos":[{"name":"0dteam/CVE-2024-22024","url":"https://github.com/0dteam/CVE-2024-22024","stars":31,"created":"2024-02-09"}]},"nuclei":[{"id":"CVE-2024-22024","name":"Ivanti Connect Secure - XXE","severity":"high","path":"http/cves/2024/CVE-2024-22024.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22024.yaml"}],"first":{"date":"2024-02-09","source":"PoC-in-GitHub","url":"https://github.com/0dteam/CVE-2024-22024"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.wiz.io/blog/ivanti-vulnerabilities-cve-2023-46805-cve-2024-21887-cve-2024-21888-and-cve-2024-21893","provenance":"source"},{"date":"2024-02-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/0dteam/CVE-2024-22024","provenance":"source"},{"date":"2024-02-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-22024","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 999 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.81,"detail":"base score 8.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}