High severity · published May 31, 2024
CVE-2024-29830
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code
8.0
CVSS
8.5%
EPSS
No
On KEV
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)8.5% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager · Ivanti
before 2022; 2022; 2022; 2022; 2022; 2022; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-29830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-29830
Vendor Advisory
https://forums.ivanti.com/s/article/Security-Advisory-May-2024
More from Endpoint Manager
8.8
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
7.5
CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
7.5
CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability