Unspecified SQL Injection Vulnerability Affects Ivanti Endpoint Manager Prior to 2022 SU 5

CVE-2023-39336

Summary

An SQL Injection vulnerability exists within Ivanti Endpoint Manager versions released before 2022 SU 5, permitting attackers with internal network access to execute arbitrary SQL queries without authentication. This flaw poses a risk of unauthorized data retrieval and may lead to remote code execution on the core server under certain conditions. Organizations using the affected software should assess their security posture and implement necessary mitigations to protect their systems from potential exploitation.

References