CVE-2024-29824

HIGHCISA KEV

8.8

Descricao

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueADJACENT_NETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado5/31/2024

Ultima modificacao10/30/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorIvanti

ProdutoEndpoint Manager (EPM)

Nome da vulnerabilidadeIvanti Endpoint Manager (EPM) SQL Injection Vulnerability

Data inclusao KEV2024-10-02

Prazo de remediacao2024-10-23

Uso em ransomwareUnknown

Produtos afetados

ivanti:endpoint_manager

Fraquezas (CWE)

CWE-89CWE-89

Referencias

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(support@hackerone.com)

https://forums.ivanti.com/s/article/Security-Advisory-May-2024(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-29824(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.