This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti fixes vulnerabilities in EPM and CSA

Ivanti fixes several vulnerabilities in the Ivanti Endpoint Manager product [1] and one vulnerability (CVE-2024-8190) in the Ivanti Cloud Service Appliance product [2]. Products and their fixes: Ivanti Endpoint Manager - 2022 SU6, 2024 with the security patch (both the July and September patches must be applied), 2024 SU1 (to be released) [1] Ivanti Cloud Services Appliance - CSA 5.0 (recommended), CSA 4.6 Patch 519 [2]

Ivanti Endpoint Manager - API secrets leakage (CVE-2024-37397)
CVSS 8.2 (High)

An unauthenticated remote attacker can cause API secrets to leak through an External XML Entity (XXE) vulnerability [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - remote code execution (CVE-2024-8191)
CVSS 7.8 (High)

An unauthenticated local attacker can achieve remote code execution due to an SQL injection vulnerability in the management console [1].

CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-8191 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - remote code execution
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can achieve remote code execution [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - Network Isolation spoofing (CVE-2024-8320)
CVSS 5.3 (Medium)

An unauthenticated remote attacker can, due to missing authentication in "Network Isolation", spoof the status of managed devices [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - managed device isolation (CVE-2024-8321)
CVSS 5.8 (Medium)

An unauthenticated remote attacker can isolate managed devices from the network [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - restricted functionality access (CVE-2024-8322)
CVSS 4.3 (Medium)

An authenticated remote attacker can, due to weak authentication in "Patch Management", access restricted functionality [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - remote code execution (CVE-2024-29847)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can achieve remote code execution due to deserialization of untrusted data in the agent portal [1].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Endpoint Manager - privilege escalation (CVE-2024-8441)
CVSS 6.7 (Medium)

An authenticated local attacker with administrator privileges can, due to a missing search path check, elevate their privileges to SYSTEM level [1].

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 10. 9. 2024.

Ivanti Cloud Service Appliance - remote code execution (CVE-2024-8190)
CVSS 7.2 (High)

An authenticated remote attacker with administrator privileges can achieve remote code execution due to an OS command injection vulnerability [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2024-8190 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 9. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 20. 9. 2024.

CESNET, z.s.p.o. Logo