Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways

Ivanti has alerted shoppers of nevertheless yet another large-severity security flaw in its Hook up Protected, Plan Secure, and ZTA gateway gadgets that could enable attackers to bypass authentication.

The issue, tracked as CVE-2024-22024, is rated 8.3 out of 10 on the CVSS scoring technique.

“An XML exterior entity or XXE vulnerability in the SAML component of Ivanti Join Safe (9.x, 22.x), Ivanti Plan Safe (9.x, 22.x) and ZTA gateways which enables an attacker to entry sure limited methods with no authentication,” the firm mentioned in an advisory.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The business said it uncovered the flaw during an inside assessment as part of its ongoing investigation into numerous security weaknesses in the products and solutions that have occur to mild considering that the start out of the calendar year, which include CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893.

CVE-2024-22024 influences the following versions of the solutions –

• Ivanti Hook up Protected (versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, and 22.5R1.1)
• Ivanti Plan Secure (variation 22.5R1.1)
• ZTA (edition 22.6R1.3)

Patches for the bug are out there in Link Protected variations 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3, and 22.6R2.2 Policy Protected variations 9.1R17.3, 9.1R18.4, and 22.5R1.2 and ZTA variations 22.5R1.6, 22.6R1.5, and 22.6R1.7.

Ivanti said there is no proof of lively exploitation of the flaw, but with CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 coming under broad abuse, it can be vital that customers shift rapidly to utilize the newest fixes.

Found this post attention-grabbing? Stick to us on Twitter  and LinkedIn to go through more special content we write-up.