CVE-2024-37397
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote…
High · published September 12, 2024
Patch now
High probability of exploitation
CVSS calls it high at 8.2. It sits in the 99.1th percentile for exploit probability.
What it is
An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
The record
Technical detail
- CVSS v3.0
- 8.2 · HIGH
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.59257 · 99.1th percentile
- Published
- 2024-09-12T01:09Z
EPSS history
Timeline