Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2024-13162

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to a

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ivanti

Description

SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ivanti Endpoint Manager

Default version status: affected

  • 2024 January-2025 Security Updateunaffected
  • 2022 SU6 January-2025 Security Updateunaffected

References