VulnerabilityAnalyzed

CVE-2024-37397

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

HIGH 8.2EPSS 59.3%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 59.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS: 59.26% probability · 99th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: ivanti/endpoint manager
Source: support@hackerone.com

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.