PT-2024-6213 · Ivanti · Ivanti Epm

Published 2024-09-10 · Updated 2024-09-12 · CVE-2024-8322

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions before 2022 SU6 Ivanti EPM versions before the 2024 September update

Description The issue is related to weak authentication in the Patch Management of Ivanti EPM, allowing a remote authenticated attacker to access restricted functionality. This can be exploited by a remote attacker to gain unauthorized access.

Recommendations For Ivanti EPM versions before 2022 SU6, update to version 2022 SU6 or later to resolve the issue. For Ivanti EPM versions before the 2024 September update, apply the 2024 September update to fix the weakness in Patch Management authentication.

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

BDU:2024-07154

CVE-2024-8322

Affected Products

Ivanti Epm

References · 10

• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8322 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07154 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8322 · Security Note
• https://twitter.com/CVEnew/status/1833615164005924870 · Twitter Post
• https://t.me/cvenotify/94457 · Telegram Post
• https://app.opencve.io/cve/CVE-2024-8322 · Note
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022?language=en_US · Note
• https://t.me/cvedetector/5303 · Telegram Post
• https://vuldb.com/?id.277104 · Note