This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ivanti fixes 2 vulnerabilities in its products
Ivanti fixes two vulnerabilities in Ivanti Endpoint Manager and Docs@Work. The vulnerability in Docs@Work is fixed in version 2.26.1 [1], while the vulnerability in Ivanti Endpoint Manager is addressed by a Hot Patch [2].
Allows an authenticated attacker on the local network to execute arbitrary code [2].
The vulnerability is present in product:
- Ivanti Endpoint Manager;
CVSS: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-37381 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command at cwe.mitre.org
The vulnerability was publicly disclosed 16. 7. 2024.
Allows an authenticated local attacker to read sensitive information stored in the application's root directory [1].
The vulnerability is present in product:
- Docs@Work; <2.26.1
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
More information:
- CVE-2024-37403 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 7. 8. 2024.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 7. 8. 2024.