CVE-2024-8441 - An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM

Back Back to CVE browser

MEDIUM

An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM

Published Sep 10, 2024

6.7

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM.

Affected products

Vendor Ivanti Product Endpoint Manager Default
unknown
Affected
- ≥ 0, < 2022_su6
- 2024_september_update

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Ivanti	Endpoint Manager	unknown	Affected ≥ 0, < 2022_su6 2024_september_update

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-427

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49178
Advisory
https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49178		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ivanti

Published Sep 10, 2024

Updated Sep 12, 2024

Reserved Sep 4, 2024

Link CVE-2024-8441

CISA Vulnrichment

Updated Sep 11, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-8441

Red Hat

No data

ENISA EUVD

Assigner ivanti

Published Sep 10, 2024

Updated Sep 12, 2024

Link EUVD-2024-49178

GitHub

No data