Description
SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Endpoint Manager | — | 2022 SU6 |
Advisories 2
- WID-SEC-2024-2109 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 16, 2024
- NCSC-2024-0369 Kwetsbaarheden verholpen in Ivanti Endpoint Manager NCSC-NL (Netherlands) · Sep 13, 2024