CVE-2024-29825

high · 8.8

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

8.8

CVSS

99.9%

EPSS (exploit prob.)

100th

EPSS percentile

2024-05-31

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
ivanti	endpoint_manager	< 2022
ivanti	endpoint_manager	2022
ivanti	endpoint_manager	2022
ivanti	endpoint_manager	2022
ivanti	endpoint_manager	2022
ivanti	endpoint_manager	2022
ivanti	endpoint_manager	2022

Check a specific version with /api/v1/cve/match.

References

https://forums.ivanti.com/s/article/Security-Advisory-May-2024
https://forums.ivanti.com/s/article/Security-Advisory-May-2024

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-29825