CVE-2024-34784

Summary

CVE-2024-34784 is a newly disclosed SQL injection vulnerability affecting Ivanti Endpoint Manager versions prior to the November 2024 Security Update and November 2022 SU6 Security Update. An authenticated attacker with administrative privileges can exploit this flaw to inject malicious SQL statements, leading to remote code execution. Successful exploitation enables the attacker to gain unauthorized access and potentially take control of the affected system. This vulnerability poses a significant risk to organizations, especially those that have not yet applied the relevant security updates. It is strongly recommended to apply the patches as soon as possible to mitigate the threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.