Lucene search
IvantiCVE-2024-8441HistorySep 10, 2024 - 9:15 p.m.
CVE-2024-8441
2024-09-1021:15:15
CWE-427
ivanti
web.nvd.nist.gov
26
20
ivanti epm
uncontrolled search path
privilege escalation
local attacker
admin privileges
2022 su6
2024 september update
CVSS3
6.7
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
9.6%
An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM.
Affected configurations
Node
ivantiendpoint_managerRange<2022
ORivantiendpoint_managerMatch2022-
ORivantiendpoint_managerMatch2022su1
ORivantiendpoint_managerMatch2022su2
ORivantiendpoint_managerMatch2022su3
ORivantiendpoint_managerMatch2022su4
ORivantiendpoint_managerMatch2022su5
ORivantiendpoint_managerMatch2024-
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ivanti | endpoint_manager | * | cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2022 | cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:* |
| ivanti | endpoint_manager | 2024 | cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* |
CNA Affected
[
{
"defaultStatus": "affected",
"product": "Endpoint Manager",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "2022 SU6",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "2024 September Security Update",
"versionType": "custom"
}
]
}
]References
Social References
More
Related
nvd
nvd
CVE-2024-8441
2024-09-10 21:15:15
vulnrichment
vulnrichment
CVE-2024-8441
2024-09-10 21:01:09
cvelist
cvelist
CVE-2024-8441
2024-09-10 21:01:09
nessus
nessus
Ivanti Endpoint Manager 2024 - September 2024 Security Update
2024-09-13 00:00:00
Ivanti Endpoint Manager 2022 - September Security Update
2024-09-18 00:00:00
CVSS3
6.7
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0
Percentile
9.6%
Related for CVE-2024-8441