Description
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | EPM | 2024 September Security Update – < 2024 September Security Update, 2022 SU6 – < 2022 SU6 | 2024 September Security Update |
Advisories 2
- WID-SEC-2024-2109 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2024
- NCSC-2024-0369 Kwetsbaarheden verholpen in Ivanti Endpoint Manager NCSC-NL (Netherlands) · Sep 13, 2024