This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ivanti Endpoint Manager fixes 6 vulnerabilities
Ivanti Endpoint Manager fixes 6 vulnerabilities with versions 2022 SU7 and 2024 SU1 [1].
Allows an unauthenticated remote attacker, using social engineering, to carry out a reflected XSS attack and obtain administrator privileges [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
More information:
- CVE-2025-22466 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Allows an authenticated local attacker, using the DLL hijacking technique, to escalate their privileges to System [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-22458 at cve.org, NVD
- CWE-427: Uncontrolled Search Path Element at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Allows an authenticated remote attacker with administrator privileges to execute code [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-22461 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Allows an unauthenticated remote attacker, under certain conditions and using social engineering, to carry out a reflected XSS attack [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2025-22465 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Allows an authenticated local attacker, due to insufficient pointer validation, to write arbitrary data to memory and carry out a DoS attack [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
More information:
- CVE-2025-22464 at cve.org, NVD
- CWE-822: Untrusted Pointer Dereference at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Allows an unauthenticated remote attacker in a man-in-the-middle (MITM) position, due to insufficient certificate validation, to intercept a limited part of the communication between the client and the server [1].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager;>=2022,<2022 SU7;>=2024,<2024 SU1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
More information:
- CVE-2025-22459 at cve.org, NVD
- CWE-296: Improper Following of a Certificate's Chain of Trust at cwe.mitre.org
The vulnerability was publicly disclosed 8. 4. 2025.
Links
By CESNET, z.s.p.o. Michaela Ručková on 11. 4. 2025.