Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-38042+1 related CVE | A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM | 7.8 group max | <1% | ||
| CVE-2023-38551 | A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s… | 8.2 | 1% | ||
| CVE-2023-5389 | An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUOC and ControlEdge… | 7.5 | <1% | ||
| CVE-2023-5390 | An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC | 5.3 | <1% | ||
CVE-2024-22059+1 related CVE | A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the… | 8.8 group max | 1% | ||
| CVE-2024-29827 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to… | 8.8 group max | 72% | ||
| CVE-2024-29848 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary… | 7.2 | 64% | ||
| CVE-2024-4701 | A path traversal issue potentially leading to remote code execution in Genie for all versions prior to 4.3.18 | 9.9 | 25% |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan May 23, 2024 Endpoint Security / Vulnerability Ivanti on Tuesday rolled out fixes to address multiple critical security flaws in Endpoint Manager (EPM) that could be exploited to achieve remote code execution under certain circumstances. Six of the 10 vulnerabilities – from CVE-2024-29822 through CVE-2024-29827 (CVSS scores: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.