CVE-2024-37381

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code.

CVSS v3 8.0 HIGH

8.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024	Vendor Advisory
https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*

History

10 Jul 2025, 18:40

Type	Values Removed	Values Added
CPE		cpe:2.3:a:ivanti:endpoint_manager:2024:-::::::
First Time		Ivanti endpoint Manager Ivanti
References	~~() https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024 -~~	() https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~8.4~~	v2 : unknown v3 : 8.0

Information

Published : 2024-07-29 06:15

Updated : 2025-07-10 18:40

NVD link : CVE-2024-37381

Mitre link : CVE-2024-37381

CVE.ORG link : CVE-2024-37381

JSON object : View

Products Affected

ivanti

endpoint_manager

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-37381", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}]}, "published": "2024-07-29T06:15:01.827", "references": [{"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024", "tags": ["Vendor Advisory"], "source": "support@hackerone.com"}, {"url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-July-2024-for-EPM-2024", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2024 flat allows an authenticated attacker within the same network to execute arbitrary code."}, {"lang": "es", "value": " Una vulnerabilidad de inyecci\u00f3n SQL no especificada en el servidor central de Ivanti EPM 2024 permite que un atacante autenticado dentro de la misma red ejecute c\u00f3digo arbitrario."}], "lastModified": "2025-07-10T18:40:11.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C7283FE-C10A-4E37-B004-15FB0CAC49A5"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}