An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

Ivanti Endpoint Manager (EPM) versions < 2022 SU6 / 2024 SU1 are vulnerable to an XML External Entity allowing an unauthenticated attacker to read arbitrary files from the system via a specially crafted request.

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the September 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32840)

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32843)   
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32845)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the September 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32840)

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32843)   
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32845)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

ID	Name	Product	Family	Severity
114524	Ivanti EPM XML External Entity	Web App Scanning	Component Vulnerability	high
207391	Ivanti Endpoint Manager 2022 - September Security Update	Nessus	Windows	critical
207247	Ivanti Endpoint Manager 2024 - September 2024 Security Update	Nessus	Windows	critical

Detections

Analytics

CVE-2024-37397

high

Tenable Plugins

high

critical

critical