PT-2024-6214 · Ivanti · Ivanti Epm

Published 2024-09-10 · Updated 2024-09-12 · CVE-2024-8441

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update

Description The issue is related to an uncontrolled search path in the agent of Ivanti EPM. This can be exploited by a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM.

Recommendations For Ivanti EPM versions prior to 2022 SU6, update to version 2022 SU6 or later to resolve the issue. For Ivanti EPM versions prior to the 2024 September update, apply the 2024 September update or later to fix the problem.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2024-07155

CVE-2024-8441

Affected Products

Ivanti Epm

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-8441 · Security Note
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07155 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8441 · Vendor Advisory
• https://twitter.com/CVEnew/status/1833615162772791410 · Twitter Post
• https://t.me/cvedetector/5305 · Telegram Post
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022?language=en_US · Note
• https://t.me/cvenotify/94458 · Telegram Post
• https://vuldb.com/?id.277099 · Note