CVE-2024-29825 is an unspecified SQL Injection vulnerability affecting the Core server of Ivanti Endpoint Manager (EPM) versions 2022 SU5 and prior. This flaw allows an unauthenticated attacker within the same network to execute arbitrary code. With a CVSS score of 8.8 (High), it presents a significant risk due to its low attack complexity and the potential for complete compromise of confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog and lacking public exploit intelligence like Metasploit or ExploitDB modules, the vulnerability has garnered community discussion and media coverage, indicating awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* | ||
2022CPE matchmatch criteria | cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.