Cyber Resilience

CVE-2024-37397

High

Published: 12 September 2024

Published
12 September 2024
Modified
10 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.1348 94.4th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37397 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 8.2 (High).

Operationally, ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

An External XML Entity (XXE) vulnerability, tracked as CVE-2024-37397 and assigned CWE-611, affects the provisioning web service in Ivanti Endpoint Manager (EPM) versions prior to 2022 SU6 or the September 2024 update. The flaw permits processing of untrusted XML input containing external entity references, which can be abused to disclose sensitive data such as API secrets. It carries a CVSS 3.1 score of 8.2, reflecting network-accessible exploitation with no authentication or user interaction required.

A remote unauthenticated attacker can send a crafted XML payload to the provisioning web service endpoint and retrieve API secrets from the server. Successful exploitation yields high confidentiality impact with limited integrity consequences, potentially enabling further attacks that leverage the exposed credentials.

The official Ivanti advisory recommends upgrading to EPM 2022 SU6 or applying the September 2024 update, which contain the fix for the XXE issue in the provisioning service.

EPSS scores for this CVE rose from a low baseline to a peak of 0.2491 (current value 0.1348), indicating emerging exploitation interest after public disclosure.

EU & UK References

Vulnerability details

An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.

CWE(s)
CWE-611

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

ivanti
endpoint manager
2022 · ≤ 2022

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing
addresses: CWE-611

Penetration testing includes XML external entity payloads, detecting XXE vulnerabilities and enabling their mitigation.

SI-4 System Monitoring
addresses: CWE-611

Identifies XML external entity processing via monitoring of unusual file/network access or resource usage.

References