This advisory is for organizations that use Ivanti Endpoint Manager (and additional Ivanti products noted below). If your organization does not use this platform, this notification may be discarded.
Summary
Last week, Ivanti issued patches to address multiple critical security flaws found in the Ivanti Endpoint Manager (EPM). Ivanti has not received any current reports of this vulnerability being exploited.
|
CVE-2024-29822 |
9.6 |
An unspecified SQL injection vulnerability in Core server of Ivanti EPM 2022 SU5 (five) and prior, allows an unauthenticated attacker within the same network to execute arbitrary code |
|
CVE-2024-29823 |
9.6 |
|
|
CVE-2024-29824 |
9.6 |
|
|
CVE-2024-29825 |
9.6 |
|
|
CVE-2024-29826 |
9.6 |
|
|
CVE-2024-29827 |
9.6 |
Additional vulnerabilities have been addressed for the following Ivanti products:
|
Ivanti Avalanche |
CVE-2024-29848 |
7.2 |
An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM. |
|
|
Ivanti Neurons for ITSM |
CVE-2024-22059 |
8.8 |
A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete information in the underlying database. This may also lead to DoS. |
|
|
CVE-2024-22060 |
8.7 |
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user to write arbitrary files into sensitive directories of ITSM server. |
||
|
Ivanti Connect Secure |
CVE-2023-38551 |
8.2 |
A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack. |
|
|
Ivanti Secure Access |
CVE-2023-38042 |
7.8 |
A local privilege escalation vulnerability in Ivanti Secure Access Client for Windows allows a low privileged user to execute code as SYSTEM. |
|
|
CVE-2023-46810 |
7.3 |
A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux allows a low privileged user to execute code as SYSTEM. |
Affected Platforms
A Security Hot Patch is available for EPM 2022 SU5 and can be applied as follows:
Note: This Hot Patch is only supported for 2022 SU5. These CVEs will be resolved future releases of EPM.
Additional Resources
https://forums.ivanti.com/s/article/KB-Security-Advisory-EPM-May-2024?language=en_US
https://forums.ivanti.com/s/article/Security-Advisory-May-2024?language=en_US