An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the September 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32840)

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32843)   
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32845)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the September 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32840)

  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32843)   
  - An unspecified SQL injection in Ivanti EPM before the 2024 September update allows a remote     authenticated attacker with admin privileges to achieve remote code execution. (CVE-2024-32845)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

ID	Name	Product	Family	Severity
207391	Ivanti Endpoint Manager 2022 - September Security Update	Nessus	Windows	critical
207247	Ivanti Endpoint Manager 2024 - September 2024 Security Update	Nessus	Windows	critical

Detections

Analytics

CVE-2024-37397

high

Tenable Plugins

critical

critical