CVE-2024-29822: SQL Injection
Published May 31, 2024
·Updated
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.
Affected Software
7 affected components
Ivanti Endpoint Manager<2022
Ivanti Endpoint Manager=2022
Ivanti Endpoint Manager=2022-su1
Ivanti Endpoint Manager=2022-su2
Ivanti Endpoint Manager=2022-su3
Ivanti Endpoint Manager=2022-su4
Ivanti Endpoint Manager=2022-su5
Event History
May 31, 2024
CVE Published
via MITRE·05:38 PM
Data Sourced
via MITRE·05:38 PM
DescriptionSeverity
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2024-29822?
CVE-2024-29822 has a high severity rating due to its potential for arbitrary code execution by an unauthenticated attacker.
2
How do I fix CVE-2024-29822?
To fix CVE-2024-29822, upgrade your Ivanti Endpoint Manager to version 2023 or later, as it addresses this vulnerability.
3
Who is affected by CVE-2024-29822?
CVE-2024-29822 affects Ivanti Endpoint Manager (EPM) versions 2022 SU5 and earlier.
4
What types of attacks can exploit CVE-2024-29822?
CVE-2024-29822 can be exploited through SQL Injection attacks that allow execution of arbitrary code within the same network.
5
Is authentication required to exploit CVE-2024-29822?
No, CVE-2024-29822 can be exploited by an unauthenticated attacker, posing a significant risk to affected systems.