CVE-2024-34779

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…

Critical · published September 12, 2024

CVSS v3.0

9.1

EPSS

24%

Percentile

97.8

In the wild

Unconfirmed

What it is

An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

The record

Technical detail

CVSS v3.0: 9.1 · CRITICAL
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.24005 · 97.8th percentile
Published: 2024-09-12T01:09Z

EPSS history

Timeline

12 SEP 01:09Z
An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to…
cvelistv5