CVE-2024-32841

Deeper analysis

CVE-2024-32841 is a SQL injection vulnerability, tracked under CWE-89, that affects Ivanti Endpoint Manager prior to the 2024 November Security Update or the 2022 SU6 November Security Update. The flaw carries a CVSS 3.1 base score of 7.2 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating a network-reachable issue that can produce high impact on confidentiality, integrity, and availability when successfully exploited.

A remote attacker who already possesses administrative credentials can supply crafted input that triggers the injection, ultimately obtaining remote code execution on the affected Endpoint Manager instance. Because the attack requires valid admin authentication and no user interaction, the primary risk surface is any externally reachable management console that has not yet been updated.

The vendor advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022 describes the November 2024 patches for both the 2024 and 2022 release trains as the corrective action. Organizations should apply the referenced security updates to eliminate the injection flaw.

EPSS values for the CVE sit at a current score of 0.1155 with a recorded peak of 0.1284; the modest range does not indicate a pronounced post-disclosure climb from a low baseline.