IT software provider Ivanti on Tuesday announced Endpoint Manager, Cloud Service Appliance, and Workspace Control security updates that address multiple critical- and high-severity vulnerabilities.
Patches released for Endpoint Manager versions 2024 and 2022 SU5 resolve 16 flaws, including 10 critical-severity bugs that could allow attackers to execute arbitrary code remotely.
The most severe of these security defects is CVE-2024-29847 (CVSS score of 10), which is described as a deserialization of untrusted data issue that can be exploited without authentication to achieve remote code execution (RCE).
The remaining nine critical-severity RCE vulnerabilities are described as SQL injection bugs that can be exploited by attackers logged in with administrator privileges.
These flaws were patched with the release of Endpoint Manager 2024 September update and 2022 SU6, which also resolve two high-severity and four medium-severity defects.
On Tuesday, Ivanti announced patches for a high-severity vulnerability in Cloud Service Appliance. Tracked as CVE-2024-8190, the issue is described as an OS command injection flaw that could allow an authenticated attacker with admin level privileges to achieve RCE.
The software vendor resolved the bug with Cloud Services Appliance 4.6 patch 519, noting that version 4.6 of the appliance has been discontinued and that this is the last fix that it would backport to it.
Cloud Services Appliance 5.0, which is the supported iteration, does not contain the vulnerability and Ivanti customers are advised to upgrade to it.
The IT software company on Tuesday released patches for six high-severity vulnerabilities in Workspace Control. The bugs could be exploited for privilege escalation, information disclosure, and arbitrary code execution.
The bugs affect Ivanti Workspace Control version 10.18.0.0 and prior, and were addressed in version 10.18.99.0 of the application.
Ivanti says it has no evidence of any of these vulnerabilities being exploited in the wild. Additional information can be found in the vendor’s security advisory.
Related: VMware Patches High-Severity Code Execution Flaw in Fusion
Related: Fortra Patches Critical Vulnerability in FileCatalyst Workflow
Related: GitLab Security Update Patches Critical Vulnerability
Related: Microsoft Releases Out-of-Band Update After Security Patch Causes Kerberos Issues
