{"id":"CVE-2024-22024","published":"2024-02-13T04:07:04Z","modified":"2025-05-09T18:26:09Z","title":"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy…","vendor":"Ivanti","product":"ICS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"ICS","versions":[">= 9.1R14.5, < 9.1R14.5",">= 9.1R17.3, < 9.1R17.3",">= 9.1R18.4, < 9.1R18.4",">= 22.1R6.1, < 22.1R6.1",">= 22.2R4.1, < 22.2R4.1",">= 22.3R1.1, < 22.3R1.1",">= 22.4R1.1, < 22.4R1.1",">= 22.5R1.2, < 22.5R1.2",">= 22.6R1.1, < 22.6R1.1",">= 22.4R2.3, < 22.4R2.3"]},{"vendor":"Ivant ","product":"ICS","versions":[">= 9.1R15.3, < 9.1R15.3"]},{"vendor":"Ivanti","product":"IPS","versions":[">= 9.1R18.4, < 9.1R18.4",">= 9.1R17.3, < 9.1R17.3",">= 22.5R1.2, < 22.5R1.2"]}],"description":{"text":"An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.","provenance":"source","from":"CVE.org"},"summary":{"text":"An XML external entity (XXE) vulnerability exists in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways. An unauthenticated attacker over the network, requiring no user interaction, can access certain restricted resources through the flaw.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:45Z"},"cvss":{"score":8.3,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.94721,"percentile":0.99857,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-02-06","exploitedFirstSeen":"2024-02-06","ransomware":false,"evidence":[{"url":"https://www.wiz.io/blog/ivanti-vulnerabilities-cve-2023-46805-cve-2024-21887-cve-2024-21888-and-cve-2024-21893","date":"2024-02-06"},{"url":"https://attackerkb.com/assessments/e3572615-0a93-4e5b-a181-432316d5c6d3","date":"2024-02-09"},{"url":"https://twitter.com/collysucker/status/1755912922516087208","date":"2024-02-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-10&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-10"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-11&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-12&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-13&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-14&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-14"},{"url":"https://www.akamai.com/blog/security-research/scanning-activity-ivanti-cve-february-2024","date":"2024-02-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-15&host_type=src&vulnerability=cve-2024-22024","date":"2024-02-15"}],"evidenceTotal":552,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"Comprehensive Threat Intelligence Report: Charming Kitten.","url":"https://otx.alienvault.com/pulse/68f0cb6d31ce2260dba39eac","created":"2025-10-16"},{"name":"Malicious Domains","url":"https://otx.alienvault.com/pulse/663deed9e807563e5b43ab07","created":"2024-05-10"},{"name":"New Campaigns from Scattered Spider","url":"https://otx.alienvault.com/pulse/663ddbdf6d0f3e9aba3f095a","created":"2024-05-10"},{"name":"Zero-day vulnerability in Ivanti software","url":"https://otx.alienvault.com/pulse/660274036e9ab3df0dbe347e","created":"2024-03-26"},{"name":"Zero-day vulnerability in Ivanti software","url":"https://otx.alienvault.com/pulse/65fb5cafa60d0a8ff0416653","created":"2024-03-20"},{"name":"Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways","url":"https://otx.alienvault.com/pulse/65e1a5b18d307f0d4139697b","created":"2024-03-01"},{"name":"Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts | Mandiant","url":"https://otx.alienvault.com/pulse/65e188af5a8a73c746708a1c","created":"2024-03-01"},{"name":"Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways | CISA","url":"https://otx.alienvault.com/pulse/65e0f6a143373e8329908891","created":"2024-02-29"},{"name":"Zero-day vulnerability in Ivanti software","url":"https://otx.alienvault.com/pulse/65cc8b23585db393574cc9d4","created":"2024-02-14"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19630","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19630","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-02-09","earliestUrl":"https://github.com/0dteam/CVE-2024-22024","repos":[{"name":"0dteam/CVE-2024-22024","url":"https://github.com/0dteam/CVE-2024-22024","stars":31,"created":"2024-02-09"}]},"nuclei":[{"id":"CVE-2024-22024","name":"Ivanti Connect Secure - XXE","severity":"high","path":"http/cves/2024/CVE-2024-22024.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-22024.yaml"}],"first":{"date":"2024-02-09","source":"PoC-in-GitHub","url":"https://github.com/0dteam/CVE-2024-22024"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.wiz.io/blog/ivanti-vulnerabilities-cve-2023-46805-cve-2024-21887-cve-2024-21888-and-cve-2024-21893","provenance":"source"},{"date":"2024-02-09","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/0dteam/CVE-2024-22024","provenance":"source"},{"date":"2024-02-13","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-22024","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":68.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 998 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9986"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":5.81,"detail":"base score 8.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}