Lucene search
HackeroneCVELIST:CVE-2024-37397HistorySep 12, 2024 - 1:09 a.m.
CVE-2024-37397
2024-09-1201:09:56
hackerone
www.cve.org
6
xml entity
ivanti epm
api secrets
CVSS3
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS
0
Percentile
9.6%
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
CNA Affected
[
{
"defaultStatus": "unaffected",
"vendor": "Ivanti",
"product": "EPM",
"versions": [
{
"version": "2024 September Security Update",
"status": "affected",
"lessThan": "2024 September Security Update",
"versionType": "custom"
},
{
"version": "2022 SU6",
"status": "affected",
"lessThan": "2022 SU6",
"versionType": "custom"
}
]
}
]Related
vulnrichment
vulnrichment
CVE-2024-37397
2024-09-12 01:09:56
nvd
nvd
CVE-2024-37397
2024-09-12 02:15:03
cve
cve
CVE-2024-37397
2024-09-12 02:15:03
nessus
nessus
Ivanti Endpoint Manager 2024 - September 2024 Security Update
2024-09-13 00:00:00
Ivanti Endpoint Manager 2022 - September Security Update
2024-09-18 00:00:00
CVSS3
8.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS
0
Percentile
9.6%
Related for CVELIST:CVE-2024-37397