high8.8Known exploited
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-10-02. Federal due date: 2024-10-23.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | Endpoint Manager | before 2022 Version 2022 |