CVE-2024-34781: SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with…

PriorityP263high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

67.71%

99.2th percentile

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
ivanti	endpoint_manager	< 2022	2022
ivanti	endpoint_manager	—	—
ivanti	endpoint_manager	—	—
ivanti	epm	>= 2022 SU6 November Security Update < 2022 SU6 November Security Update	2022 SU6 November Security Update
ivanti	epm	>= 2024 November Security Update < 2024 November Security Update	2024 November Security Update

Detection & IOCsextracted from sources · hover to see the quote

→Target product is Ivanti Endpoint Manager; monitor for anomalous SQL injection patterns in requests made by authenticated admin-level users against EPM endpoints ↗
→Focus detection on remote authenticated admin sessions that trigger unexpected SQL query structures or database errors, potentially leading to OS command execution (RCE via SQLi) ↗

·Exploitation requires the attacker to already hold admin privileges on Ivanti Endpoint Manager; this limits the attack surface to privileged accounts but does not eliminate risk from compromised admin credentials ↗
·Affected versions are Ivanti Endpoint Manager before the 2024 November Security Update or before 2022 SU6 November Security Update; patched versions are not vulnerable ↗

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.