Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.6 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

99.95 %

Predictive Probability

Percentile Rank

100.0 th

Documented as more likely to be exploited than 100.0% of known CVEs.

Detection Date

Oct 02, 2024

Remediation Due

Oct 23, 2024

CISA Catalog Active

Threat Analysis

Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.

Remediation Directive

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://forums.ivanti.com/s/article/Security-Advisory-May-2024

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2024-29824