High severity · published Jul 29, 2024
CVE-2024-37381
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code
8.0
CVSS
3.1%
EPSS
No
On KEV
Description
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager · Ivanti
2024 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-37381
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-37381
Vendor Advisory
https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024
More from Endpoint Manager
8.8
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
7.5
CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
7.5
CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability