CVE-2024-29205 - Vulnerability Details - OpenCVE

ReportizFlow

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ivanti	Connect Secure Policy Secure

No data.

No data.

References

Link	Providers
https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

History

Thu, 03 Oct 2024 22:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Ivanti Ivanti connect Secure Ivanti policy Secure
CPEs		cpe:2.3:a:ivanti:connect_secure:::::::: cpe:2.3:a:ivanti:policy_secure::::::::
Vendors & Products		Ivanti Ivanti connect Secure Ivanti policy Secure
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2024-04-24T23:12:51.923Z

Updated: 2024-10-03T21:30:48.706Z

Reserved: 2024-03-19T01:04:06.323Z

Link: CVE-2024-29205

Vulnrichment

Updated: 2024-08-02T01:10:54.619Z

NVD

Status : Awaiting Analysis

Published: 2024-04-25T06:15:57.923

Modified: 2024-11-21T09:07:48.940

Link: CVE-2024-29205

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29205", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2024-03-19T01:04:06.323Z", "datePublished": "2024-04-24T23:12:51.923Z", "dateUpdated": "2024-10-03T21:30:48.706Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Ivanti", "product": "Connect Secure", "versions": [{"version": "9.1R18.5", "status": "affected", "lessThan": "9.1R18.5", "versionType": "semver"}, {"version": "22.6R2.3", "status": "affected", "lessThan": "22.6R2.3", "versionType": "semver"}, {"version": "9.1R17.4", "status": "affected", "lessThan": "9.1R17.4", "versionType": "semver"}, {"version": "22.2R3", "status": "affected", "lessThan": "22.2R3", "versionType": "semver"}, {"version": "22.5R2.4", "status": "affected", "lessThan": "22.5R2.4", "versionType": "semver"}, {"version": "9.1R14.6", "status": "affected", "lessThan": "9.1R14.6", "versionType": "semver"}, {"version": "9.1R16.4", "status": "affected", "lessThan": "9.1R16.4", "versionType": "semver"}, {"version": "9.1R15.4", "status": "affected", "lessThan": "9.1R15.4", "versionType": "semver"}, {"version": "22.2R4.2", "status": "affected", "lessThan": "22.2R4.2", "versionType": "semver"}, {"version": "22.4R1.2", "status": "affected", "lessThan": "22.4R1.2", "versionType": "semver"}, {"version": "22.6R1.2", "status": "affected", "lessThan": "22.6R1.2", "versionType": "semver"}, {"version": "22.1R6.2", "status": "affected", "lessThan": "22.1R6.2", "versionType": "semver"}, {"version": "22.3R1.2", "status": "affected", "lessThan": "22.3R1.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "Ivanti ", "product": "Connect Secure", "versions": [{"version": "22.4R2.4", "status": "affected", "lessThan": "22.4R2.4", "versionType": "semver"}, {"version": "22.5R1.3", "status": "affected", "lessThan": "22.5R1.3", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "Ivanti", "product": "Policy Secure", "versions": [{"version": "22.5R1.3", "status": "affected", "lessThan": "22.5R1.3", "versionType": "semver"}, {"version": "9.1R18.5", "status": "affected", "lessThan": "9.1R18.5", "versionType": "semver"}, {"version": "9.1R17.4", "status": "affected", "lessThan": "9.1R17.4", "versionType": "semver"}, {"version": "22.2R3", "status": "affected", "lessThan": "22.2R3", "versionType": "semver"}]}], "references": [{"url": "https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-04-24T23:12:51.923Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-703", "lang": "en", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "affected": [{"vendor": "ivanti", "product": "connect_secure", "cpes": ["cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "9.1R18.5", "status": "affected"}, {"version": "22.6R2.3", "status": "affected"}, {"version": "9.1R17.4", "status": "affected"}, {"version": "22.2R3", "status": "affected"}, {"version": "22.5R2.4", "status": "affected"}, {"version": "9.1R14.6", "status": "affected"}, {"version": "9.1R15.4", "status": "affected"}, {"version": "22.2R4.2", "status": "affected"}, {"version": "22.4R1.2", "status": "affected"}, {"version": "22.6R1.2", "status": "affected"}, {"version": "22.1R6.2", "status": "affected"}, {"version": "22.3R1.2", "status": "affected"}, {"version": "22.4R2.4", "status": "affected"}, {"version": "22.5R1.3", "status": "affected"}]}, {"vendor": "ivanti", "product": "policy_secure", "cpes": ["cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "22.5R1.3", "status": "affected"}, {"version": "9.1R18.5", "status": "affected"}, {"version": "9.1R17.4", "status": "affected"}, {"version": "22.2R3", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-20T14:41:02.374802Z", "id": "CVE-2024-29205", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-03T21:30:48.706Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:54.619Z"}, "title": "CVE Program Container", "references": [{"url": "https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:54.619Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29205", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-20T14:41:02.374802Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*"], "vendor": "ivanti", "product": "connect_secure", "versions": [{"status": "affected", "version": "9.1R18.5"}, {"status": "affected", "version": "22.6R2.3"}, {"status": "affected", "version": "9.1R17.4"}, {"status": "affected", "version": "22.2R3"}, {"status": "affected", "version": "22.5R2.4"}, {"status": "affected", "version": "9.1R14.6"}, {"status": "affected", "version": "9.1R15.4"}, {"status": "affected", "version": "22.2R4.2"}, {"status": "affected", "version": "22.4R1.2"}, {"status": "affected", "version": "22.6R1.2"}, {"status": "affected", "version": "22.1R6.2"}, {"status": "affected", "version": "22.3R1.2"}, {"status": "affected", "version": "22.4R2.4"}, {"status": "affected", "version": "22.5R1.3"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*"], "vendor": "ivanti", "product": "policy_secure", "versions": [{"status": "affected", "version": "22.5R1.3"}, {"status": "affected", "version": "9.1R18.5"}, {"status": "affected", "version": "9.1R17.4"}, {"status": "affected", "version": "22.2R3"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-703", "description": "CWE-703 Improper Check or Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-20T14:54:25.257Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "Ivanti", "product": "Connect Secure", "versions": [{"status": "affected", "version": "9.1R18.5", "lessThan": "9.1R18.5", "versionType": "semver"}, {"status": "affected", "version": "22.6R2.3", "lessThan": "22.6R2.3", "versionType": "semver"}, {"status": "affected", "version": "9.1R17.4", "lessThan": "9.1R17.4", "versionType": "semver"}, {"status": "affected", "version": "22.2R3", "lessThan": "22.2R3", "versionType": "semver"}, {"status": "affected", "version": "22.5R2.4", "lessThan": "22.5R2.4", "versionType": "semver"}, {"status": "affected", "version": "9.1R14.6", "lessThan": "9.1R14.6", "versionType": "semver"}, {"status": "affected", "version": "9.1R16.4", "lessThan": "9.1R16.4", "versionType": "semver"}, {"status": "affected", "version": "9.1R15.4", "lessThan": "9.1R15.4", "versionType": "semver"}, {"status": "affected", "version": "22.2R4.2", "lessThan": "22.2R4.2", "versionType": "semver"}, {"status": "affected", "version": "22.4R1.2", "lessThan": "22.4R1.2", "versionType": "semver"}, {"status": "affected", "version": "22.6R1.2", "lessThan": "22.6R1.2", "versionType": "semver"}, {"status": "affected", "version": "22.1R6.2", "lessThan": "22.1R6.2", "versionType": "semver"}, {"status": "affected", "version": "22.3R1.2", "lessThan": "22.3R1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ivanti ", "product": "Connect Secure", "versions": [{"status": "affected", "version": "22.4R2.4", "lessThan": "22.4R2.4", "versionType": "semver"}, {"status": "affected", "version": "22.5R1.3", "lessThan": "22.5R1.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ivanti", "product": "Policy Secure", "versions": [{"status": "affected", "version": "22.5R1.3", "lessThan": "22.5R1.3", "versionType": "semver"}, {"status": "affected", "version": "9.1R18.5", "lessThan": "9.1R18.5", "versionType": "semver"}, {"status": "affected", "version": "9.1R17.4", "lessThan": "9.1R17.4", "versionType": "semver"}, {"status": "affected", "version": "22.2R3", "lessThan": "22.2R3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US"}], "descriptions": [{"lang": "en", "value": "An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2024-04-24T23:12:51.923Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29205", "state": "PUBLISHED", "dateUpdated": "2024-10-03T21:30:48.706Z", "dateReserved": "2024-03-19T01:04:06.323Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2024-04-24T23:12:51.923Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}