Vulnerability · Published May 31, 2024 · Assigned by hackerone

CVE-2024-29846

High 8.4

In plain English

A high-severity SQL injection in EPM from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.5% (higher than 95% of all known vulnerabilities).

Severity (CVSS 3.0)8.4High

Exploit odds (30 days)8.5%top 4.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an authenticated attacker within the same network to execute arbitrary code.

Affected products (as reported)

Vendor	Product	Versions
Ivanti	EPM	2022 SU5 – through 2022 SU5

Weakness: CWE-89 · Vector: CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://www.ivanti.com/blog/topics/security-advisory