CVE-2019-10651

An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution

published July 11, 2019

CVSS
โ€”
EPSS
4%
Percentile
91.1
In the wild
Unconfirmed
What it is

โš ๏ธ Remote code execution lurking in older versions of Ivanti Endpoint Manager could let attackers take control without breaking a sweat! Think of it like a hotel that left its back door ajar โ€” anyone with insider knowledge can waltz in and access whatever they want, especially if staff never checked the security logs! An attacker could execute arbitrary code on the server, which means it's like giving them the master key to all your data and functions. They could potentially install malware, steal sensitive information, or disrupt services entirely. Yikes! ๐Ÿ”ฅ

Put simply

Think of it like a hotel that left its back door ajar โ€” anyone with insider knowledge can waltz in and access whatever they want, especially if staff never checked the security logs! This vulnerability in Ivanti Endpoint Manager affects versions 2017.3 and 2018.x prior to the April 2019 update. It allows unauthorized remote code execution, meaning attackers can run their own commands on the server as if they were the legitimate user.

What to do

An attacker could execute arbitrary code on the server, which means it's like giving them the master key to all your data and functions. They could potentially install malware, steal sensitive information, or disrupt services entirely. Yikes! ๐Ÿ”ฅ To secure your system, make sure to update to version 2018.3 SU3 or later. If you're still using 2017.3, apply the latest patch or upgrade. Regularly checking for updates can keep vulnerabilities at bay! ๐Ÿ›ก๏ธ You've got this! By staying updated and vigilant, you're one step closer to fortifying your defenses! ๐Ÿ’ชโœจ

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04272 ยท 91.1th percentile
Published
2019-07-11T17:31Z
EPSS history
Timeline
  • 11 JUL 17:31Z
    An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3, with remote code execution
    cvelistv5