« Volver al listado

CVE-2024-34783

Estado: ModificadaAlta (7.2)—

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ivanti — Endpoint Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34783",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34783",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T03:55:20.889611Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Ivanti",
          "product": "EPM",
          "versions": [
            {
              "status": "affected",
              "version": "2024 September Security Update",
              "lessThan": "2024 September Security Update",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "2022 SU6",
              "lessThan": "2022 SU6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ivanti",
          "product": "endpoint_manager",
          "versions": [
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2022_su6",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "2024",
              "lessThan": "2024_september_security_update",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-09-12T02:15:03.380",
  "references": [
    {
      "url": "https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution."
    },
    {
      "lang": "es",
      "value": "Una inyección SQL no especificada en Ivanti EPM antes de 2022 SU6 o la actualización de septiembre de 2024 permite que un atacante autenticado remoto con privilegios de administrador logre la ejecución remota de código."
    }
  ],
  "lastModified": "2026-06-17T07:34:03.367",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1F6549B-CF5D-4607-B67D-5489905A1705",
              "versionEndExcluding": "2022"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46580865-5177-4E55-BDAC-73DA4B472B35"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E57E12B5-B789-450C-9476-6C4C151E6993"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E47C65B3-56DD-4D65-8B4B-6AFFE28E94F2"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "10D6EAB7-B14B-45E9-92B9-4FADFBBB08AF"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1877FB55-76BA-4714-ABB8-47258132F537"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F9E8D45-5F12-4D45-A74E-C314FA3618A3"
            },
            {
              "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C7283FE-C10A-4E37-B004-15FB0CAC49A5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}