CVE-2024-32842: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

An unspecified SQL injection vulnerability (CVE-2024-32842) was identified in Ivanti Endpoint Manager (EPM) affecting versions before 2022 SU6 and the 2024 September update. The vulnerability was discovered and reported through HackerOne, with the initial CVE record created on September 11, 2024 (CVE Mitre).

The vulnerability is classified as a SQL injection (CWE-89) that affects Ivanti EPM systems. It received a CVSS v3.1 base score of 7.2 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, while HackerOne assigned it a more severe CVSS score of 9.1 (CRITICAL) with a vector string of CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability allows a remote authenticated attacker with admin privileges to achieve remote code execution on affected systems (NVD).

Ivanti has released patches to address this vulnerability. Users are advised to upgrade to EPM version 2024 SU1 or 2022 SU6, depending on their current version (Hacker News).

This vulnerability was part of a larger security update from Ivanti that addressed multiple critical vulnerabilities. The company has stated that they have improved their internal scanning, manual exploitation and testing capabilities, and made enhancements to their responsible disclosure process (Hacker News).