Unauthenticated SQL Injection Vulnerability Affects Ivanti EPM
CVE-2024-29827

8.8HIGH

Key Information:

Vendor
Ivanti
Status
Epm
Vendor
CVE Published:
31 May 2024

Summary

An unspecified SQL injection vulnerability exists in the Core server of Ivanti EPM versions 2022 SU5 and earlier. This flaw allows unauthenticated attackers within the same network environment to execute arbitrary code, potentially compromising the integrity and confidentiality of the affected system. Organizations using Ivanti EPM should assess their exposure to this vulnerability and take appropriate measures to protect their network.

Affected Version(s)

EPM 2022 SU5

References

https://forums.ivanti.com/s/article/Security-Advisory-May...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.