CVE-2024-22052

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22052
A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:lts:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.3:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.5:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.6:*:*:*:*:*:*:*
History

08 Apr 2024, 22:52

Type Values Removed Values Added
First Time Ivanti policy Secure
Ivanti
Ivanti connect Secure
CWE CWE-476
CPE cpe:2.3:a:ivanti:policy_secure:9.1:r18:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.3:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r11:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.2:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.2:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r12:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r10:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r14:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r9:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.6:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r15:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r8:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r13:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r16:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r7:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r15:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r3.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r18:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.3:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.5:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r4.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r17:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r17:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.1:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r14:*:*:lts:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r16:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.4:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r12:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r13:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.0:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r11.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.4:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.5:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:9.1:r4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.6:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:9.1:r3:*:*:*:*:*:*
References () https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US - () https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US - Vendor Advisory

05 Apr 2024, 12:40

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de desreferencia de puntero nulo en el componente IPSec de Ivanti Connect Secure (9.x, 22.x) e Ivanti Policy Secure permite que un usuario malintencionado no autenticado envíe solicitudes especialmente manipuladas para bloquear el servicio, provocando así un ataque DoS.

04 Apr 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-04 20:15

Updated : 2024-04-08 22:52

NVD link : CVE-2024-22052

Mitre link : CVE-2024-22052

CVE.ORG link : CVE-2024-22052

JSON object : View

Products Affected

ivanti

  • policy_secure
  • connect_secure
CWE
CWE-476

NULL Pointer Dereference