CVE-2024-29822

—

CVSS 3.1

8.8 high

EPSS

64%p99

Published

May 31, 2024 (May 31, 2024)

Modified

Jun 17, 2026

Description

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

Vendors: ivanti
Products: endpoint manager
Weakness: CWE-89
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (64.4%)

In the news2 stories

Critical SQL Injection flaws impact Ivanti Endpoint Manager (EPM)

Security AffairsMay 23, 10:49 UTC · May 23, 2024Vulnerability CVE-2024-29822 CVE-2024-29823 CVE-2024-29824+7 CVEs

Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager

The Hacker NewsMay 23, 09:21 UTC · May 23, 2024Vulnerability in the wildCVE-2024-29822 CVE-2024-29827 CVE-2024-29828+12 CVEs