Ivanti has released updates for Ivanti Endpoint Manager which addresses high and critical severity vulnerabilities.

Ivanti is not aware of any customers being exploited by these vulnerabilities at the time of disclosure.

Security Advisory EPM November 2024 for EPM 2024 and EPM 2022 SU6

Primary Product

Endpoint Manager

Created Date

12 Nov 2024 15:00:14

Last Modified Date

12 Nov 2024 21:33:24

Summary 

Ivanti has released updates for Ivanti Endpoint Manager which addresses high and critical severity vulnerabilities.  

We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. 

Vulnerability Details: 

CVE Number 

Description 

CVSS Score (Severity) 

CVSS Vector 

CWE 

CVE-2024-34787 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required.  

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50322 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. 

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-32839 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32841 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.  

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32844 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-32847 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34780 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-37376 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34781 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34782 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-34784 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50323 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is required. 

7.8 (High) 

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50324 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50326 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50327 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50328 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. 

7.2 (High) 

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

CVE-2024-50329 

Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required. 

8.8 (High) 

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 

CWE-22 

CVE-2024-50330 

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution. 

9.8 (Critical) 

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 

CWE-89 

Affected Versions 

Product Name 

Affected Version(s) 

Resolved Version(s) 

Patch Availability 

Ivanti Endpoint Manager (EPM) 

2024 September security update and prior, 
2022 SU6 September security update and prior 

2024 November Security Update, 2022 SU6 November Security Update