CVE-2024-13162

CVE-2024-13162 is a SQL injection vulnerability (CWE-89) affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. It enables remote code execution and represents incomplete fixes for the earlier CVE-2024-32848. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts with network accessibility, low attack complexity, and a requirement for high privileges.

A remote authenticated attacker possessing admin privileges can exploit this SQL injection flaw to execute arbitrary code on the affected Ivanti EPM server. No user interaction is required, and the attack operates over the network with relatively low complexity once authentication is achieved.

Ivanti's security advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6 details the January-2025 security updates for EPM 2024 and EPM 2022 SU6 as the primary mitigation, urging administrators to apply these patches promptly to address the vulnerability and its predecessor.