SQL Injection Vulnerability in Ivanti Endpoint Manager Products
CVE-2024-13162

7.2HIGH

Key Information:

Vendor
Ivanti
Status
Endpoint Manager
Vendor
CVE Published:
14 January 2025

Summary

A SQL injection flaw exists in Ivanti Endpoint Manager versions prior to the January 2025 Security Update. This vulnerability allows a remote authenticated attacker, possessing admin privileges, to achieve remote code execution by exploiting incomplete fixes from a previous vulnerability. Organizations using affected versions must update their systems promptly to mitigate the potential risk of unauthorized system control.

Affected Version(s)

Endpoint Manager 2024 January-2025 Security Update

Endpoint Manager 2024 January-2025 Security Update

Endpoint Manager 2022 SU6 January-2025 Security Update

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.