Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Ivanti Patches Critical Vulnerabilities in Endpoint Manager

Ivanti has released patches for multiple vulnerabilities in Endpoint Manager, Cloud Service Appliance, and Workspace Control.

Ivanti vulnerability

IT software provider Ivanti on Tuesday announced Endpoint Manager, Cloud Service Appliance, and Workspace Control security updates that address multiple critical- and high-severity vulnerabilities.

Patches released for Endpoint Manager versions 2024 and 2022 SU5 resolve 16 flaws, including 10 critical-severity bugs that could allow attackers to execute arbitrary code remotely.

The most severe of these security defects is CVE-2024-29847 (CVSS score of 10), which is described as a deserialization of untrusted data issue that can be exploited without authentication to achieve remote code execution (RCE).

The remaining nine critical-severity RCE vulnerabilities are described as SQL injection bugs that can be exploited by attackers logged in with administrator privileges.

These flaws were patched with the release of Endpoint Manager 2024 September update and 2022 SU6, which also resolve two high-severity and four medium-severity defects.

On Tuesday, Ivanti announced patches for a high-severity vulnerability in Cloud Service Appliance. Tracked as CVE-2024-8190, the issue is described as an OS command injection flaw that could allow an authenticated attacker with admin level privileges to achieve RCE.

The software vendor resolved the bug with Cloud Services Appliance 4.6 patch 519, noting that version 4.6 of the appliance has been discontinued and that this is the last fix that it would backport to it.

Cloud Services Appliance 5.0, which is the supported iteration, does not contain the vulnerability and Ivanti customers are advised to upgrade to it.

Advertisement. Scroll to continue reading.

The IT software company on Tuesday released patches for six high-severity vulnerabilities in Workspace Control. The bugs could be exploited for privilege escalation, information disclosure, and arbitrary code execution.

The bugs affect Ivanti Workspace Control version 10.18.0.0 and prior, and were addressed in version 10.18.99.0 of the application.

Ivanti says it has no evidence of any of these vulnerabilities being exploited in the wild. Additional information can be found in the vendor’s security advisory.

Related: VMware Patches High-Severity Code Execution Flaw in Fusion

Related: Fortra Patches Critical Vulnerability in FileCatalyst Workflow

Related: GitLab Security Update Patches Critical Vulnerability

Related: Microsoft Releases Out-of-Band Update After Security Patch Causes Kerberos Issues

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Don’t miss this Live Attack demonstration to learn how hackers operate and gain the knowledge to strengthen your defenses.

Register

Join us as we share best practices for uncovering risks and determining next steps when vetting external resources, implementing solutions, and procuring post-installation support.

Register

People on the Move

Mike Byron has been named Chief Financial Officer (CFO) at Exabeam.

Ex-GitHub chief technology officer Mike Hanley has joined GM as CISO.

Network security and compliance assurance firm Titania has appointed Victoria Dimmick as CEO.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.