SB20241115102 - Multiple vulnerabilities in Ivanti Endpoint Manager
Published: November 15, 2024 Updated: November 18, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 secuirty vulnerabilities.
1) SQL injection (CVE-ID: CVE-2024-34784)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
2) SQL injection (CVE-ID: CVE-2024-50328)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
3) SQL injection (CVE-ID: CVE-2024-50327)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
4) SQL injection (CVE-ID: CVE-2024-50326)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
5) SQL injection (CVE-ID: CVE-2024-34782)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
6) Path traversal (CVE-ID: CVE-2024-34787)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim into uploading a specially crafted file and overwrite arbitrary files on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
7) SQL injection (CVE-ID: CVE-2024-34781)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
8) SQL injection (CVE-ID: CVE-2024-37376)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
9) SQL injection (CVE-ID: CVE-2024-34780)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
10) SQL injection (CVE-ID: CVE-2024-32847)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
11) SQL injection (CVE-ID: CVE-2024-32844)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
12) SQL injection (CVE-ID: CVE-2024-32841)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
13) SQL injection (CVE-ID: CVE-2024-32839)
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote privileged user can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
14) Path traversal (CVE-ID: CVE-2024-50322)
The vulnerability allows a remote attacker to compromise the affected system.
The
vulnerability exists due to input validation error when processing
directory traversal sequences. A remote attacker can trick the victim
into uploading a specially crafted file and overwrite arbitrary files on
the system.
15) SQL injection (CVE-ID: CVE-2024-50323)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim into uploading a specially crafted file and execute arbitrary SQL commands within the application database.
16) SQL injection (CVE-ID: CVE-2024-50330)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
17) Path traversal (CVE-ID: CVE-2024-50324)
The vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote privileged user can send a specially crafted HTTP request and read arbitrary files on the system.
18) Path traversal (CVE-ID: CVE-2024-50329)
The vulnerability allows a remote attacker to compromise the affected system.
The
vulnerability exists due to input validation error when processing
directory traversal sequences. A remote attacker can trick the victim
into uploading a specially crafted file and overwrite arbitrary files on
the system.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Remediation
Install update from vendor's website.
References
- https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022
- https://www.zerodayinitiative.com/advisories/ZDI-24-1500/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1508/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1507/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1506/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1499/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1501/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1498/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1497/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1502/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1496/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1495/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1494/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1493/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1503/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1504/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1510/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1505/
- https://www.zerodayinitiative.com/advisories/ZDI-24-1509/