Description
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | Endpoint Manager | — | 2024 SU1 |
Advisories 2
- WID-SEC-2025-0758 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2025
- NCSC-2025-0120 Kwetsbaarheden verholpen in Ivanti Endpoint Manager NCSC-NL (Netherlands) · Apr 9, 2025