Paper/Archive/CVE-2024-36130

CVE-2024-36130

Ivanti EPMM — An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 82.9.829 × 2016.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.

Affected

ProductAffectedFixed inSource

EPMM12.1.0.1 – < 12.1.0.112.1.0.1CNA

endpoint_manager_mobile< 12.1.0.112.1.0.1CISA-ADP

Scores by source

hackerone (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-for-Mobile-EPMM-July-2024