CVE-2024-29824

HIGHCISA KEV

8.8

Beschreibung

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorADJACENT_NETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht5/31/2024

Zuletzt geandert10/30/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerIvanti

ProduktEndpoint Manager (EPM)

SchwachstellennameIvanti Endpoint Manager (EPM) SQL Injection Vulnerability

KEV Aufnahmedatum2024-10-02

Behebungsfrist2024-10-23

Ransomware-NutzungUnknown

Betroffene Produkte

ivanti:endpoint_manager

Schwachen (CWE)

CWE-89CWE-89

Referenzen

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(support@hackerone.com)

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29824(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.