This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Ivanti Connect Secure and Policy Secure fix 4 vulnerabilities

Ivanti fixes 4 vulnerabilities in the Ivanti Connect Secure and Policy Secure products. The fixed versions for Ivanti Connect Secure are 22.1R6.2, 22.2R4.2, 22.3R1.2, 22.4R1.2, 22.4R2.4, 22.5R1.3, 22.5R2.4, 22.6R2.3, 9.1R14.6, 9.1R15.4, 9.1R16.4, 9.1R17.4, 9.1R18.5 and for Policy Secure the versions are 22.4R1.2, 22.5R1.3, 22.6R1.2, 9.1R16.4, 9.1R17.4, 9.1R18.5 [1].

Ivanti Connect Secure and Policy Secure - heap overflow (CVE-2024-21894)
CVSS 8.2 (High)

An unauthenticated remote attacker can send specially crafted requests and thereby cause a DoS attack and, under certain circumstances, execute code without authorization [1].

The vulnerability is present in products:

  • Ivanti Connect Secure; >= 2.1R6.0,< 2.1R6.2; >=22.2R4.0, <22.2R4.2; >=22.3R1.0, <22.3R1.2; >= 22.4R.0, <22.4R1.2; >=22.4.R.2.0, <22.4R2.4; >=22.5R1.0, <22.5R1.3; >=22.5R2.0, <22.5R2.4; >=22.6R2.0, <22.6R2.3; >=9.1R14.0, <9.1R14.6; >=9.1R15.0, <9.1R15.4; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5
  • Ivanti Policy Secure; >=22.4R1.0, <22.4R1.2; >=22.5R1.0, <22.5R1.3; >=22.6R1.0, <22.6R1.2; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2024.

Ivanti Connect Secure and Policy Secure - null pointer dereference (CVE-2024-22052)
CVSS 7.5 (High)

An unauthenticated remote attacker can send specially crafted requests and thereby cause a DoS attack [1].

The vulnerability is present in products:

  • Ivanti Connect Secure; >= 2.1R6.0,< 2.1R6.2; >=22.2R4.0, <22.2R4.2; >=22.3R1.0, <22.3R1.2; >= 22.4R.0, <22.4R1.2; >=22.4.R.2.0, <22.4R2.4; >=22.5R1.0, <22.5R1.3; >=22.5R2.0, <22.5R2.4; >=22.6R2.0, <22.6R2.3; >=9.1R14.0, <9.1R14.6; >=9.1R15.0, <9.1R15.4; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5
  • Ivanti Policy Secure; >=22.4R1.0, <22.4R1.2; >=22.5R1.0, <22.5R1.3; >=22.6R1.0, <22.6R1.2; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2024.

Ivanti Connect Secure and Policy Secure - heap overflow (CVE-2024-22053)
CVSS 8.2 (High)

An unauthenticated remote attacker can send specially crafted requests and thereby cause a DoS attack and, under certain circumstances, read data from memory without authorization [1].

The vulnerability is present in products:

  • Ivanti Connect Secure; >= 2.1R6.0,< 2.1R6.2; >=22.2R4.0, <22.2R4.2; >=22.3R1.0, <22.3R1.2; >= 22.4R.0, <22.4R1.2; >=22.4.R.2.0, <22.4R2.4; >=22.5R1.0, <22.5R1.3; >=22.5R2.0, <22.5R2.4; >=22.6R2.0, <22.6R2.3; >=9.1R14.0, <9.1R14.6; >=9.1R15.0, <9.1R15.4; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5
  • Ivanti Policy Secure; >=22.4R1.0, <22.4R1.2; >=22.5R1.0, <22.5R1.3; >=22.6R1.0, <22.6R1.2; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

More information:

The vulnerability was publicly disclosed 2. 4. 2024.

Ivanti Connect Secure and Policy Secure - XXE (CVE-2024-22023)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can send requests containing a specially crafted XML file and thereby cause a DoS attack [2].

The vulnerability is present in products:

  • Ivanti Connect Secure; >= 2.1R6.0,< 2.1R6.2; >=22.2R4.0, <22.2R4.2; >=22.3R1.0, <22.3R1.2; >= 22.4R.0, <22.4R1.2; >=22.4.R.2.0, <22.4R2.4; >=22.5R1.0, <22.5R1.3; >=22.5R2.0, <22.5R2.4; >=22.6R2.0, <22.6R2.3; >=9.1R14.0, <9.1R14.6; >=9.1R15.0, <9.1R15.4; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5
  • Ivanti Policy Secure; >=22.4R1.0, <22.4R1.2; >=22.5R1.0, <22.5R1.3; >=22.6R1.0, <22.6R1.2; >=9.1R16.0, <9.1R16.4; >=9.1R17.0, <9.1R17.4; >=9.1R18.0, <9.1R18.5

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 2. 4. 2024.

By CESNET, z.s.p.o. Martin Krajči on 5. 4. 2024.

CESNET, z.s.p.o. Logo