Lucene search
HackeroneCVE-2024-34785HistorySep 12, 2024 - 2:15 a.m.
CVE-2024-34785
2024-09-1202:15:03
CWE-89
hackerone
web.nvd.nist.gov
27
sql injection
ivanti epm
remote code execution
cve-2024-34785
admin privileges
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
9.5
Confidence
High
EPSS
0.001
Percentile
20.0%
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected configurations
Node
ivantiendpoint_managerRange<2022
ORivantiendpoint_managerMatch2022-
ORivantiendpoint_managerMatch2022su1
ORivantiendpoint_managerMatch2022su2
ORivantiendpoint_managerMatch2022su3
ORivantiendpoint_managerMatch2022su4
ORivantiendpoint_managerMatch2022su5
ORivantiendpoint_managerMatch2024-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ivanti | endpoint_manager | * | cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2024 | cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "unaffected",
"vendor": "Ivanti",
"product": "EPM",
"versions": [
{
"version": "2024 September Security Update",
"status": "affected",
"lessThan": "2024 September Security Update",
"versionType": "custom"
},
{
"version": "2022 SU6",
"status": "affected",
"lessThan": "2022 SU6",
"versionType": "custom"
}
]
}
]Related
nvd
nvd
CVE-2024-34785
2024-09-12 02:15:03
vulnrichment
vulnrichment
CVE-2024-34785
2024-09-12 01:09:56
cvelist
cvelist
CVE-2024-34785
2024-09-12 01:09:56
thn
thn
Ivanti Releases Urgent Security Updates for Endpoint Manager Vulnerabilities
2024-09-11 06:30:00
nessus
nessus
Ivanti Endpoint Manager 2024 - September 2024 Security Update
2024-09-13 00:00:00
Ivanti Endpoint Manager 2022 - September Security Update
2024-09-18 00:00:00
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AI Score
9.5
Confidence
High
EPSS
0.001
Percentile
20.0%
Related for CVE-2024-34785