High severity · published May 31, 2024
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
In wildKEV
8.8
CVSS
99.9%
EPSS
Yes
On KEV
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 2, 2024
Federal remediation dueOct 23, 2024
Ransomware campaign useNot known
Affected products
Which versions
EP
EPM · Ivanti
2022 SU5 through 2022 SU5 · source: vendor
EM
Endpoint Manager · Ivanti
before 2022; 2022; 2022; 2022; 2022; 2022; +1 more · source: NVD, CISA
EM
Endpoint Manager (EPM) · Ivanti
All versions, or not specified · source: KEV