PT-2024-6315 · Ivanti · Ivanti Epm

Published

2024-06-05

·

Updated

2024-09-16

·

CVE-2024-34785

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update
Description The issue is related to a SQL injection vulnerability in the LoadMotherboardTable method of Ivanti EPM, which does not properly protect the SQL query structure. This allows a remote authenticated attacker with admin privileges to achieve remote code execution. The vulnerability requires authentication to be exploited.
Recommendations For Ivanti EPM versions prior to 2022 SU6, update to version 2022 SU6 or later to resolve the issue. For Ivanti EPM versions prior to the 2024 September update, apply the 2024 September update or later to resolve the issue. As a temporary workaround, consider restricting access to the LoadMotherboardTable method until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2024-07266
CVE-2024-34785
ZDI-24-1221

Affected Products

Ivanti Epm