CVE-2024-32848

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Ivanti	EPM	>= 2024 September Security Update, < 2024 September Security Update; >= 2022 SU6, < 2022 SU6
ivanti	endpoint_manager	—

References

https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022Vendor Advisory

Timeline

Published: Sep 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-328497.8Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local attacker to unintentiona CVE-2024-32855.4The Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2024-328509.8Improper neutralization of special elements used in a command ('Command Injection') exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 CVE-2024-328527.5Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileg CVE-2024-328537.8Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privilege CVE-2024-328546.7Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attack CVE-2024-328554.4Dell Client Platform BIOS contains an Out-of-bounds Write vulnerability in an externally developed component. A high privileged attacker wit CVE-2024-328566.0Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attack CVE-2024-328577.8Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially CVE-2024-328588.2Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attack CVE-2024-328598.2Dell Client Platform BIOS contains an Improper Input Validation vulnerability in an externally developed component. A high privileged attack CVE-2024-32867.5A buffer overflow vulnerability was identified in some Lenovo printers that could allow an unauthenticated user to trigger a device restart