Vulnerabilities fixed in Ivanti Endpoint Manager

🗓️ 13 Nov 2024 10:42:35Reported by NCSCType

Ivanti fixed Endpoint Manager vulnerabilities enabling SQL injection, circumvention, and remote code execution.

Reporter	Title	Published	Views	Family All 209
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks relates to the lack of security measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely.	13 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of security measures regarding SQL query structures. This allows attackers to execute arbitrary code within the root user’s context.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of protective measures for SQL query structures, allowing attackers to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks lies in the lack of security measures regarding SQL query structures. This allows attackers to execute arbitrary code within the root user’s context.	22 Nov 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ivanti Endpoint Manager software for managing endpoints in information networks arises from incorrect restrictions on the path name to the restricted access directory. This allows a perpetrator to execute arbitrary code.	22 Nov 202400:00	–	bdu_fstec

Vulners

Node

ivanti endpoint_managerMatch2022

ivanti endpoint_managerMatch2024

Source	Link
forums	www.forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022

13 Nov 2024 10:42Current

8.2High risk

Vulners AI Score8.2

CVSS 3.19.8

CVSS 37.8

EPSS0.67711

SSVC