CVE-2024-50328: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

A SQL injection vulnerability (CVE-2024-50328) was identified in Ivanti Endpoint Manager, affecting versions before the 2024 November Security Update or 2022 SU6 November Security Update. The vulnerability was discovered on October 22, 2024, and publicly disclosed on November 12, 2024. This security flaw specifically affects the GetDetectedVulnerabilitiesDataTable method implementation in Ivanti Endpoint Manager (ZDI Advisory, NVD).

The vulnerability stems from improper validation of user-supplied strings before their use in SQL query construction within the GetDetectedVulnerabilitiesDataTable method. It has been assigned a CVSS v3.1 base score of 7.2 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (ZDI Advisory, NVD).

If successfully exploited, this vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary code in the context of the service account, potentially leading to remote code execution on affected installations of Ivanti Endpoint Manager (ZDI Advisory).

Ivanti has released security updates to address this vulnerability. Users are advised to apply either the 2024 November Security Update or the 2022 SU6 November Security Update, depending on their version (ZDI Advisory).