CVE-2024-32839

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 November Security Update Ivanti Endpoint Manager versions prior to 2022 SU6 November Security Update

Description The issue is related to a lack of protection against SQL query structure exploitation in Ivanti Endpoint Manager, allowing a remote authenticated attacker with admin privileges to achieve remote code execution through SQL injection.

Recommendations For versions prior to 2024 November Security Update, update to the 2024 November Security Update or later. For versions prior to 2022 SU6 November Security Update, update to the 2022 SU6 November Security Update or later. As a temporary workaround, consider restricting access to the MP VistaReport component until a patch is available.