Ivanti Security Updates – 11 September 2024

The addressed vulnerabilities could allow the attacker to obtain sensitive information, bypass security restrictions, gain elevated privileges, or execute arbitrary code and gain access to the affected system.

Sample of the addressed vulnerabilities:

1. Deserialization of Untrusted Data in The Agent Portal of Ivanti EPM (CVE-2024-29847):

• CVSS: 10
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. Insufficient Server-Side Controls in The Management Console of Ivanti Workspace Control (CVE-2024-44106):

• CVSS: 8.8
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Gain Privileges

Affected Products:

• Ivanti Endpoint Manager.
• Ivanti CSA 4.6.
• Ivanti Workspace Control (IWC).