onyx --cves cve-2024-22023

CVE-2024-22023

score: <0.1
cvss: 5.3
epss: 3.0%
published: 2024-04-04
kev added: —
first seen: 2026-10-21

Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure contain an XML external entity (XXE) vulnerability caused by improper handling of XML entities in the SAML component, letting unauthenticated attackers cause resource exhaustion and a limited-time denial of service, exploit requires sending crafted XML requests.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2024-04-04 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-476 CWE-703

References 1

https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US