CVE-2024-29824

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.0

9.6 CRITICALCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

99.95% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2024-10-02

Nuclei

critical

Published

2024-05-31

Updated

2025-10-21

Proof-of-concept exploits (2)

• R4be1/CVE-2024-298241★ · 2024-06-19
• horizon3ai/CVE-2024-2982424★ · 2024-06-12

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29824.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/ivanti_epm_recordgo…

References

• CVE Record
• NVD entry

Related

• CVE-2024-2982
• CVE-2024-2983
• CVE-2024-2981
• CVE-2024-2984
• CVE-2024-2980
• CVE-2024-29847