PT-2024-6322 · Ivanti · Ivanti Epm

Published 2024-06-28 · Updated 2024-12-13 · CVE-2024-37397

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update

Description The issue is related to an External XML Entity (XXE) vulnerability in the provisioning web service, allowing a remote unauthenticated attacker to leak API secrets. This vulnerability is associated with incorrect restriction of XML links to external objects, which can be exploited by a remote attacker to access confidential information.

Recommendations For Ivanti EPM versions prior to 2022 SU6, update to version 2022 SU6 or later to resolve the issue. For Ivanti EPM versions prior to the 2024 September update, apply the 2024 September update to fix the vulnerability. As a temporary workaround, consider restricting access to the provisioning web service to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-07273

CVE-2024-37397

ZDI-24-1212

Affected Products

Ivanti Epm

References · 17

• https://zerodayinitiative.com/advisories/ZDI-24-1212 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37397 · Vendor Advisory
• https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022 · Vendor Advisory
• https://safe-surf.ru/upload/VULN-new/VULN.2024-09-16.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37397 · Security Note
• https://bdu.fstec.ru/vul/2024-07273 · Security Note
• https://cybersecurity-help.cz/vdb/SB2024091108 · Note
• https://twitter.com/VulmonFeeds/status/1834027779303575697 · Twitter Post
• https://twitter.com/cracbot/status/1835921691538862533 · Twitter Post
• https://d4mianwayne.github.io/posts/ivanti-endpoint-manager-xxe-cve-2024-37397 · Note
• https://twitter.com/D4mianWayne/status/1860736372698431826 · Twitter Post
• https://t.me/cybersecuritytechnologies/11552 · Telegram Post
• https://twitter.com/D4mianWayne/status/1835923003902656557 · Twitter Post
• https://twitter.com/UAFnUg/status/1862063140042936737 · Twitter Post
• https://t.me/cvedetector/5419 · Telegram Post