by Kastro
Paper/Archive/CVE-2024-50330

CVE-2024-50330

Ivanti Endpoint Manager — SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauth…

EPSS 40%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution.

Affected

ProductAffectedFixed inSource
Endpoint Managersee advisory2024 November Security UpdateCNA
endpoint_manager< 2024_november_security_update2024_november_security_updateCISA-ADP
endpoint_manager< 2022_su6_november_security_update2022_su6_november_security_updateCISA-ADP

Scores by source

ivanti (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022