CVE-2024-50328

Summary

CVE-2024-50328 is a newly disclosed SQL injection vulnerability affecting Ivanti Endpoint Manager versions prior to the November 2024 Security Update and 2022 SU6 November Security Update. An authenticated attacker with administrative privileges can exploit this flaw to execute remote code, posing a significant threat to affected organizations. The vulnerability is caused by insufficient input validation in the software's SQL queries, allowing an attacker to inject malicious code and manipulate database queries to achieve unintended functionality. It is crucial for organizations using Ivanti Endpoint Manager to apply the relevant security updates as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.