Vulnerability · Published May 31, 2024 · Assigned by hackerone

CVE-2024-29827

Critical 9.6

In plain English

A critical-severity SQL injection in EPM from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 71.7% (higher than 99.4% of all known vulnerabilities).

Severity (CVSS 3.0)9.6Critical

Exploit odds (30 days)71.7%top 0.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Affected products (as reported)

Vendor	Product	Versions
Ivanti	EPM	2022 SU5 – through 2022 SU5

Weakness: CWE-89 · Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://forums.ivanti.com/s/article/Security-Advisory-May-2024