ZDI-CAN-25312: ZDI-25-114: Ivanti Endpoint Manager Patch Unrestricted File Upload Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. Alternatively, no user interaction is required if the attacker has administrative credentials to the application. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2024-13171.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25312?
ZDI-CAN-25312 is classified as a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code.
How do I fix ZDI-CAN-25312?
To mitigate ZDI-CAN-25312, ensure that you update to the latest version of Ivanti Endpoint Manager as per the vendor's security advisory.
What is the impact of ZDI-CAN-25312?
The impact of ZDI-CAN-25312 includes potential unauthorized remote code execution on affected systems.
Is user interaction required to exploit ZDI-CAN-25312?
Yes, user interaction is required for the exploitation of ZDI-CAN-25312, as the victim must visit a malicious page or open a malicious file.
Which software is affected by ZDI-CAN-25312?
ZDI-CAN-25312 affects Ivanti Endpoint Manager installations that are not updated with the necessary security patches.