Ivanti on Thursday announced patches for a high-severity vulnerability impacting enterprise VPN and network access products.
Tracked as CVE-2024-22024 (CVSS score of 8.3) and described as an XML external entity (XXE) issue, the security defect was identified in the SAML component of Ivanti Connect Secure, Policy Secure, and ZTA gateway appliances.
According to Ivanti, the successful exploitation of the bug could allow an unauthenticated attacker to access certain restricted resources.
“This vulnerability only affects a limited number of supported versions – Ivanti Connect Secure (version 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2 and 22.5R1.1), Ivanti Policy Secure version 22.5R1.1 and ZTA version 22.6R1.3,” the IT security and services company notes in its advisory.
Patches were included in Connect Secure versions 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3 and 22.6R2.2, Policy Secure versions 9.1R17.3, 9.1R18.4 and 22.5R1.2, and ZTA gateways versions 22.5R1.6, 22.6R1.5 and 22.6R1.7.
Ivanti also notes that patches released on January 31 to address two zero-day vulnerabilities exploited in attacks against government and military entities, along with four other security defects in its enterprise VPN products, mitigate CVE-2024-22024 as well.
“We have no evidence of this vulnerability being exploited in the wild as it was found during our internal review and testing of our code,” Ivanti says.
Although it has no evidence of CVE-2024-22024 being exploited against its customers, Ivanti urges them to ensure they have the latest patches.
Customers who applied the January 31 or February 1 patches and factory reset their VPN appliances do not need to perform another factory reset, the company notes.
While Ivanti says in its advisory that the vulnerability was identified internally, attack surface management firm WatchTowr claims that its researchers found it and reported it to Ivanti on February 2.
Ivanti, WatchTowr says, initially assigned a 2023 CVE to the bug, but later told the security firm that the issue is tracked as CVE-2024-22024.
Related: CISA Sets 48-Hour Deadline for Removal of Insecure Ivanti Products
Related: Ivanti EPMM Vulnerability Targeted in Attacks as Exploitation of VPN Flaws Increases
Related: Ivanti Patches Critical Vulnerability in Endpoint Manager
