9.1
Critical
CVE-2024-32846 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated…
Description
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EPM | Versions not published | |
| endpoint_manager 2024 | earliest → < 2024 | 2024 |
References
- forums.ivanti.com forums.ivanti.com
Timeline
- Published
- Last modified
Other CVEs of EPM
The 33 CVEs of EPM →
CVE-2024-34787
Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…
7.8
High
CVE-2024-32847
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…
7.2
High
CVE-2024-32839
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…
7.2
High
CVE-2024-34780
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update…
7.2
High