Ivanti Security Updates – 22 May 2024

The addressed vulnerabilities could allow the attacker to conduct denial of service attacks, obtain sensitive information, perform cross-site scripting attacks, or execute arbitrary code and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Ivanti EPM Core Server SQL Injection Vulnerability (CVE-2024-29827):

• CVSS: 9.6
• Attack Vector: Adjacent Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information

2. Ivanti Neurons for ITSM Unrestricted file Upload Vulnerability (CVE-2024- 22060):

• CVSS: 8.7
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High
• User Interaction: None
• Consequences: Gain Privilege