Multiple vulnerabilities involving SQL injection have been identified in Ivanti Endpoint Manager.
These vulnerabilities could potentially enable malicious actors to carry out various unauthorized actions, including initiating Denial of Service attacks and executing arbitrary code on affected systems.
One of the vulnerabilities found was a SQL injection vulnerability in Ivanti Neurons for ITSM, while the rest were discovered in the Ivanti Endpoint Manager (EPM).
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
The severity of these vulnerabilities ranges from 8.4 (High) to 9.6 (Critical).
According to the advisory, there were 11 SQL injection vulnerabilities identified, which were given the CVEs as
Among these SQL injection vulnerabilities, six had a 9.6 (Critical) severity.
These vulnerabilities were due to an unspecified SQL injection flaw in the Core server of Ivanti EPM 2022 SU5 and prior versions, which allows an unauthenticated attacker on the same network to execute arbitrary code on the vulnerable instances.
The other five vulnerabilities had an 8.4 (High) severity, which also existed due to a similar unspecified SQL injection flaw but require an authentication that could enable an authenticated attacker on the same network to execute arbitrary code on the vulnerable instance.
However, Users of Ivanti Endpoint Manager are recommended to upgrade to the latest versions to prevent threat actors from exploiting these SQL injection vulnerabilities.
ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…