Remote Code Execution Vulnerability in Ivanti EPM Agent Portal

CVE-2024-29847
9.8CRITICAL

Key Information

Vendor
Ivanti
Status
Epm
Vendor
CVE Published:
12 September 2024

Badges

🔥 No. 1 Trending😄 Trended👾 Exploit Exists🔴 Public PoC📰 News Worthy

Summary

The vulnerability (CVE-2024-29847) affects the agent portal of Ivanti Endpoint Manager, allowing remote unauthenticated attackers to achieve remote code execution. Ivanti has released updates to fix this vulnerability, as well as 15 additional vulnerabilities, including critical SQL injection flaws and an external XML Entity (XXE) vulnerability. While none of these vulnerabilities are currently being exploited, it is crucial for admins to upgrade their installations quickly to mitigate the potential risk. The company has also increased its efforts to improve product security and has pledged to intensify its internal scanning, manual exploitation, and testing capabilities. These updates reflect Ivanti taking security more seriously following a series of zero-day vulnerabilities in its solutions being exploited by attackers.

Affected Version(s)

EPM < 2024 September Security Update

EPM < 2022 SU6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-29847
Created by horizon3ai

CVE-2024-29847
Created by sinsinology

News Articles

favicon imageThe Stack

October Patch Tuesday: MSFT patches 2 exploited zero days

Microsoft has patched a brace of zero days that are under active attack as part of October Patch Tuesday 2024.

1 month ago

favicon imageBleepingComputer

Exploit code released for critical Ivanti RCE flaw, patch now

A proof-of-concept (PoC) exploit for CVE-2024-29847, a critical remote code execution (RCE) vulnerability in Ivanti Endpoint Manager, is now publicly released, making it crucial to update devices.

2 months ago

favicon imageCSO Online

Newly patched Ivanti CSA flaw under active exploitation

The Cloud Service Appliance command injection vulnerability — patched as part of the final update for end-of-life CSA version 4.6 — has been attacked in the wild, Ivanti confirms.

2 months ago

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🔥

    Vulnerability reached the number 1 worldwide trending spot.

  • Vulnerability started trending.

  • 👾

    Exploit exists.

  • Risk change from: null to: 10 - (CRITICAL)

  • Vulnerability published.

  • First article discovered by Help Net Security

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database2 Proof of Concept(s)4 News Article(s)
.