VulnerabilityModified

CVE-2024-29847

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CRITICAL 9.8EPSS 52.9%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 52.9%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 52.91% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: ivanti/endpoint manager
Source: support@hackerone.com

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.