Ivanti Endpoint Manager Vulnerability Advisory: XXE, SQLi, RCE (CVE-2024-37397, CVE-2024-8191)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - CVE-2024-37397: An external XML entity (XXE) vulnerability that allows remote unauthenticated attackers to leak API keys. - CVE-2024-8191: An SQL injection vulnerability in the management console that allows remote unauthenticated attackers to execute remote code. 2. Vulnerability Details: - CVE-2024-32846: An unspecified SQL injection vulnerability that allows remote unauthenticated attackers to execute remote code with administrator privileges. - CVE-2024-32848: An unspecified SQL injection vulnerability that allows remote unauthenticated attackers to execute remote code with administrator privileges. - CVE-2024-34779: An unspecified SQL injection vulnerability that allows remote unauthenticated attackers to execute remote code with administrator privileges. - CVE-2024-34783: An unspecified SQL injection vulnerability that allows remote unauthenticated attackers to execute remote code with administrator privileges. - CVE-2024-34785: An unspecified SQL injection vulnerability that allows remote unauthenticated attackers to execute remote code with administrator privileges. - CVE-2024-8320: Authentication bypass in network isolation that allows remote unauthenticated attackers to spoof network isolation status. - CVE-2024-8321: Authentication bypass in network isolation that allows remote unauthenticated attackers to isolate managed devices. - CVE-2024-8322: Authentication bypass in patch management that allows remote unauthenticated attackers to access restricted features. - CVE-2024-29847: A data deserialization vulnerability in the agent portal that allows remote unauthenticated attackers to execute remote code. - CVE-2024-8441: An uncontrolled search path in the agent portal that allows local unauthenticated attackers to escalate privileges. 3. Affected Versions: - Ivanti Endpoint Manager 2024: Requires application of security patches from July and September. - Ivanti Endpoint Manager 2022 SU5 and earlier: Requires application of the September security patch. 4. Solutions: - Ivanti Endpoint Manager 2024: Download and apply the security hotfix. - Ivanti Endpoint Manager 2022: Apply SU6. 5. Vulnerability Details: - CVE-2024-37397: CVSS score of 8.2, impact scope C:High/L:A:N. - CVE-2024-8191: CVSS score of 7.8, impact scope C:High/L:A:H. This information helps users understand the severity of the vulnerabilities, the affected versions, and how to apply patches to remediate these vulnerabilities.

Goal Reached Thanks to every supporter — we hit 100%!

Ivanti Endpoint Manager Vulnerability Advisory: XXE, SQLi, RCE (CVE-2024-37397, CVE-2024-8191)