CVE-2024-29205: An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a…

High severity · published Apr 24, 2024

CVE-2024-29205

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a…

7.5

CVSS

1.6%

EPSS

On KEV

Description

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Connect Secure · Ivanti

9.1R18.5 before 9.1R18.5; 22.6R2.3 before 22.6R2.3; 9.1R17.4 before 9.1R17.4; 22.2R3 before 22.2R3; 22.5R2.4 before 22.5R2.4; 9.1R14.6 before 9.1R14.6; +9 more · source: vendor, CISA

Policy Secure · Ivanti

22.5R1.3 before 22.5R1.3; 9.1R18.5 before 9.1R18.5; 9.1R17.4 before 9.1R17.4; 22.2R3 before 22.2R3 · source: vendor, CISA

Affected product

Connect Secure

Ivanti

All Connect Secure CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-29205

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-29205

forums.ivanti.com

https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US