Skip to content
fr Sign in
10.0 Critical

CVE-2024-29847 Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows…

Description

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CVSS 3.0 detail

Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
None
Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
EPM Versions not published
endpoint_manager 2024 earliest → < 2024 2024

References

Timeline

  1. Published
  2. Last modified

Other CVEs of EPM

The 33 CVEs of EPM →
CVE-2024-34787 Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update… 7.8 High CVE-2024-32841 SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update… 7.2 High CVE-2024-32847 SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update… 7.2 High CVE-2024-34781 SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update… 7.2 High
Track this CVE