CVE-2024-22024

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which…

High · published February 13, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.3. It sits in the 99.9th percentile for exploit probability.

CVSS v3.0

8.3

EPSS

95%

Percentile

99.9

In the wild

Unconfirmed

What it is

An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.

The record

Technical detail

CVSS v3.0: 8.3 · HIGH
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.94721 · 99.9th percentile
Published: 2024-02-13T04:07Z

EPSS history

Timeline

13 FEB 04:07Z
An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which…
cvelistv5