CVE-2024-29824: critical vulnerability in Ivanti EPM
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A flaw in Ivanti EPM 2022 SU5 allows an attacker on the same network to inject malicious SQL commands without logging in, leading to arbitrary code execution on the server.
An unauthenticated SQL injection vulnerability (CWE-89) in the Core server component permits network-adjacent attackers to execute arbitrary SQL queries, which can be leveraged to achieve remote code execution. Pre-condition: attacker must be on the same network segment; impact includes full server compromise.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.