PT-2024-3759 · Ivanti · Ivanti Epm

Published 2024-05-21 · Updated 2024-10-03 · CVE-2024-29822

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions 2022 SU5 and prior

Description The issue allows an unauthenticated attacker within the same network to execute arbitrary code due to an unspecified SQL Injection vulnerability in the Core server. This can be exploited by injecting specially crafted SQL code, potentially enabling remote code execution.

Recommendations For Ivanti EPM versions 2022 SU5 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-04105

CVE-2024-29822

ZDI-24-505

Affected Products

Ivanti Epm

References · 9

• https://bdu.fstec.ru/vul/2024-04105 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-29822 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-505 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29822 · Vendor Advisory
• https://forums.ivanti.com/s/article/Security-Advisory-May-2024 · Vendor Advisory
• https://t.me/thehackernews/5000 · Telegram Post
• https://vuldb.com/?id.266260 · Note
• https://twitter.com/fletch_ai/status/1793507336142926315 · Twitter Post
• https://forums.ivanti.com/s/article/Security-Advisory-May-2024?language=en_US · Note