CVE-2025-62385: SQL Injection
SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ivanti Endpoint Managerto a version that resolves this vulnerability.Fixed in 2024 SU5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62385?
CVE-2025-62385 has been classified with a high severity due to its potential for unauthorized data access.
How do I fix CVE-2025-62385?
To fix CVE-2025-62385, you should upgrade Ivanti Endpoint Manager to the latest released version beyond 2024.
Who is affected by CVE-2025-62385?
Any organization using Ivanti Endpoint Manager versions up to 2024, including security updates SU1, SU2, and SU3, is affected by CVE-2025-62385.
What type of attack is CVE-2025-62385 related to?
CVE-2025-62385 is related to SQL injection attacks that can lead to unauthorized reading of database content.
What data can an attacker access through CVE-2025-62385?
An attacker exploiting CVE-2025-62385 can potentially read arbitrary data from the Ivanti Endpoint Manager database.