Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways

Ivanti has alerted shoppers of nevertheless yet another large-severity security flaw in its Hook up Protected, Plan Secure, and ZTA gateway gadgets that could enable attackers to bypass authentication.

The issue, tracked as CVE-2024-22024, is rated 8.3 out of 10 on the CVSS scoring technique.

“An XML exterior entity or XXE vulnerability in the SAML component of Ivanti Join Safe (9.x, 22.x), Ivanti Plan Safe (9.x, 22.x) and ZTA gateways which enables an attacker to entry sure limited methods with no authentication,” the firm mentioned in an advisory.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The business said it uncovered the flaw during an inside assessment as part of its ongoing investigation into numerous security weaknesses in the products and solutions that have occur to mild considering that the start out of the calendar year, which include CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893.

CVE-2024-22024 influences the following versions of the solutions –

• Ivanti Hook up Protected (versions 9.1R14.4, 9.1R17.2, 9.1R18.3, 22.4R2.2, and 22.5R1.1)
• Ivanti Plan Secure (variation 22.5R1.1)
• ZTA (edition 22.6R1.3)

Patches for the bug are out there in Link Protected variations 9.1R14.5, 9.1R17.3, 9.1R18.4, 22.4R2.3, 22.5R1.2, 22.5R2.3, and 22.6R2.2 Policy Protected variations 9.1R17.3, 9.1R18.4, and 22.5R1.2 and ZTA variations 22.5R1.6, 22.6R1.5, and 22.6R1.7.

Ivanti said there is no proof of lively exploitation of the flaw, but with CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893 coming under broad abuse, it can be vital that customers shift rapidly to utilize the newest fixes.

Found this post attention-grabbing? Stick to us on Twitter  and LinkedIn to go through more special content we write-up.