{"id":"CVE-2024-29826","published":"2024-05-31T17:38:31Z","modified":"2024-08-02T01:17:58Z","title":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated…","vendor":"Ivanti","product":"EPM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"EPM","versions":[">= 2022 SU5, <= 2022 SU5"]}],"description":{"text":"An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an unspecified SQL injection vulnerability in the Core server component of Ivanti EPM, affecting version 2022 SU5 and earlier. An unauthenticated attacker on the same network as the affected server can exploit it to execute arbitrary code.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:29Z"},"cvss":{"score":9.6,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.99877,"percentile":0.99964,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-May-2024","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-26820","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-26820","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-05-31","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-29826","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":26.7,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.72,"detail":"base score 9.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}