CVE-2024-50327: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2024-50327) was identified in Ivanti Endpoint Manager, affecting versions before the 2024 November Security Update and 2022 SU6 November Security Update. The vulnerability was disclosed on November 12, 2024, and allows remote authenticated attackers with admin privileges to achieve remote code execution (NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and has received a CVSS v3.1 base score of 7.2 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires network access, low attack complexity, and high privileges, but no user interaction, potentially affecting confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability allows an attacker with administrative privileges to execute remote code on the affected system, potentially compromising the confidentiality, integrity, and availability of the Ivanti Endpoint Manager (NVD).

Organizations are advised to update to either the 2024 November Security Update or the 2022 SU6 November Security Update to address this vulnerability (NVD).