CVE-2024-29824

HIGHCISA KEV

8.8

Description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published5/31/2024

Last Modified10/30/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorIvanti

ProductEndpoint Manager (EPM)

Vulnerability NameIvanti Endpoint Manager (EPM) SQL Injection Vulnerability

KEV Date Added2024-10-02

Remediation Due Date2024-10-23

Ransomware UseUnknown

Affected Products

ivanti:endpoint_manager

Weaknesses (CWE)

CWE-89CWE-89

References

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(support@hackerone.com)

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29824(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.