CVE-2024-50329: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

A path traversal vulnerability has been identified in Ivanti Endpoint Manager (CVE-2024-50329), affecting versions before the 2024 November Security Update and 2022 SU6 November Security Update. The vulnerability was disclosed on October 22, 2024, and allows remote unauthenticated attackers to achieve remote code execution, though user interaction is required for successful exploitation (MITRE CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This scoring indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges but does need user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability poses significant risks as it allows attackers to achieve remote code execution on affected systems. The high CVSS score of 8.8 indicates severe potential impacts on system security, with possible compromise of confidentiality, integrity, and availability of the affected systems (NVD).

Organizations using affected versions of Ivanti Endpoint Manager should update to either the 2024 November Security Update or the 2022 SU6 November Security Update to address this vulnerability (MITRE CVE).