Description
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | EPM | 2024 September Security Update – < 2024 September Security Update, 2022 SU6 – < 2022 SU6 | 2024 September Security Update |
Advisories 4
- WID-SEC-2025-0072 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 10, 2025
- NCSC-2025-0017 Kwetsbaarheden verholpen in Ivanti Endpoint Manager NCSC-NL (Netherlands) · Jan 15, 2025
- WID-SEC-2024-2109 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2024
- NCSC-2024-0369 Kwetsbaarheden verholpen in Ivanti Endpoint Manager NCSC-NL (Netherlands) · Sep 13, 2024