Virtual Event Now Live: Zero Trust Strategies Summit! - Login for Access
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Ivanti Patches Critical Vulnerabilities in Endpoint Manager

Ivanti has released patches for multiple vulnerabilities in Endpoint Manager, Cloud Service Appliance, and Workspace Control.

Ivanti vulnerability

IT software provider Ivanti on Tuesday announced Endpoint Manager, Cloud Service Appliance, and Workspace Control security updates that address multiple critical- and high-severity vulnerabilities.

Patches released for Endpoint Manager versions 2024 and 2022 SU5 resolve 16 flaws, including 10 critical-severity bugs that could allow attackers to execute arbitrary code remotely.

The most severe of these security defects is CVE-2024-29847 (CVSS score of 10), which is described as a deserialization of untrusted data issue that can be exploited without authentication to achieve remote code execution (RCE).

The remaining nine critical-severity RCE vulnerabilities are described as SQL injection bugs that can be exploited by attackers logged in with administrator privileges.

These flaws were patched with the release of Endpoint Manager 2024 September update and 2022 SU6, which also resolve two high-severity and four medium-severity defects.

On Tuesday, Ivanti announced patches for a high-severity vulnerability in Cloud Service Appliance. Tracked as CVE-2024-8190, the issue is described as an OS command injection flaw that could allow an authenticated attacker with admin level privileges to achieve RCE.

The software vendor resolved the bug with Cloud Services Appliance 4.6 patch 519, noting that version 4.6 of the appliance has been discontinued and that this is the last fix that it would backport to it.

Cloud Services Appliance 5.0, which is the supported iteration, does not contain the vulnerability and Ivanti customers are advised to upgrade to it.

Advertisement. Scroll to continue reading.

The IT software company on Tuesday released patches for six high-severity vulnerabilities in Workspace Control. The bugs could be exploited for privilege escalation, information disclosure, and arbitrary code execution.

The bugs affect Ivanti Workspace Control version 10.18.0.0 and prior, and were addressed in version 10.18.99.0 of the application.

Ivanti says it has no evidence of any of these vulnerabilities being exploited in the wild. Additional information can be found in the vendor’s security advisory.

Related: VMware Patches High-Severity Code Execution Flaw in Fusion

Related: Fortra Patches Critical Vulnerability in FileCatalyst Workflow

Related: GitLab Security Update Patches Critical Vulnerability

Related: Microsoft Releases Out-of-Band Update After Security Patch Causes Kerberos Issues

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join SecurityWeek and Hitachi Vantara for this this webinar to gain valuable insights and actionable steps to enhance your organization's data security and resilience.

Register

Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.

Register

People on the Move

Former Darktrace CEO Poppy Gustafsson has joined the UK government as Minister for Investment.

Nupur Goyal has joined cloud identity security and management solutions provider Saviynt as VP of Product Marketing.

Threat intelligence firm Intel 471 has appointed Mark Huebeler as its COO and CFO.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.