PT-2024-6301 · Ivanti · Ivanti Epm

Published 2024-06-05 · Updated 2024-09-16 · CVE-2024-32843

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions before 2022 SU6 Ivanti EPM versions before the 2024 September update

Description The issue is related to an unspecified SQL injection in Ivanti EPM, which allows a remote authenticated attacker with admin privileges to achieve remote code execution. This is due to the lack of protection against SQL query structure manipulation. The exploitation of this issue can enable an attacker to execute arbitrary code by injecting specially crafted SQL code.

Recommendations For Ivanti EPM versions before 2022 SU6, update to version 2022 SU6 or later to resolve the issue. For Ivanti EPM versions before the 2024 September update, apply the 2024 September update or later to fix the vulnerability. As a temporary workaround, consider restricting access to the SQL query functionality to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-07250

CVE-2024-32843

ZDI-24-1215

Affected Products

Ivanti Epm

References · 16

• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-1215 · Security Note
• https://bdu.fstec.ru/vul/2024-07250 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32843 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32843 · Vendor Advisory
• https://twitter.com/AegisLens/status/1834372626577252376 · Twitter Post
• https://t.me/cvedetector/5428 · Telegram Post
• https://vuldb.com/?id.277152 · Note
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022?language=en_US · Note
• https://twitter.com/AegisLens/status/1834372632201896391 · Twitter Post
• https://twitter.com/CveFindCom/status/1834050119349449214 · Twitter Post
• https://twitter.com/cracbot/status/1835921680369356884 · Twitter Post
• https://twitter.com/CVEnew/status/1834054573754827171 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834026265830916339 · Twitter Post
• https://t.me/cvenotify/94289 · Telegram Post