Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-29847
CVE-2024-29847:
Ivanti Endpoint Manager vulnerability analysis and mitigation
Overview
A critical vulnerability (CVE-2024-29847) was discovered in Ivanti Endpoint Manager (EPM), affecting versions before 2022 SU6 and the 2024 version prior to the September update. The vulnerability involves deserialization of untrusted data in the agent portal, which allows remote unauthenticated attackers to achieve remote code execution. The vulnerability was assigned a CVSS v3.1 score of 9.8 (Critical) by NIST and 10.0 by HackerOne (NVD, ZDI).
Technical details
The vulnerability exists within the AgentPortal service of Ivanti EPM. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. The vulnerability has been classified as CWE-502 (Deserialization of Untrusted Data). The issue allows attackers to execute code in the context of SYSTEM privileges (ZDI).
Impact
If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager with SYSTEM level privileges. The attack does not require authentication, making it particularly dangerous for exposed systems (ZDI).
Mitigation and workarounds
Ivanti has released security updates to address this vulnerability. Organizations running EPM 2024 should apply both July and September security patches, with a 2024 SU1 update to be released. For EPM 2022 users, upgrading to version 2022 SU6 is recommended (Arctic Wolf).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management