by Kastro
Paper/Archive/CVE-2024-29826

CVE-2024-29826

Ivanti EPM — An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the…

EPSS 100%CVSS 9.6
critical.is priorityof 100
49
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 100.01.000 × 2020.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Affected

ProductAffectedFixed inSource
EPM2022 SU5 – 2022 SU5–CNA
endpoint_manager≤ 2022 SU5–CISA-ADP

Scores by source

hackerone (CNA)9.6CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/Security-Advisory-May-2024