Vulnerability · Published Aug 7, 2024 · Assigned by hackerone
CVE-2024-36130
Critical 9.8
In plain English
A critical-severity security flaw in EPMM from Ivanti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS 3.0)9.8Critical
Exploit odds (30 days)2.3%top 17.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H