CVE-2024-29824 - Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
Project:Ivanti
Product:Endpoint Manager (EPM)
Date Added:2024-10-02Due Date:2024-10-23
Vulnerability Name
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
Description
Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
Known To Be Used in Ransomware Campaigns?
Unknown
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://forums.ivanti.com/s/article/Security-Advisory-May-2024
https://nvd.nist.gov/vuln/detail/CVE-2024-29824
Related News Articles
Nation-State Attackers Exploiting Ivanti CSA Flaws for Network InfiltrationOctober 14, 2024
Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively ExploitedOctober 9, 2024
Critical Ivanti Endpoint Manager flaw exploited (CVE-2024-29824)October 3, 2024
Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to PatchOctober 3, 2024
Critical Ivanti RCE flaw with public exploit now used in attacksOctober 3, 2024