4.9Medium
Ivanti Endpoint Manager Mobile
Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.
9.8Critical
KEV
Used in ransomware
CVE-2021-44529Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
Known exploited — Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
CISA confirmed this vulnerability is used in real attacks on 25.03.2024. Remediation deadline for US federal agencies: 15.04.2024.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2021-44529
Description
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Weakness (CWE):
CWE-94
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| ivanti | endpoint_manager_cloud_services_appliance | ≤ 4.6_patch_512 | |
| — | Ivanti EPM | 4.6.0-512 |
References and patches
- https://forums.ivanti.com/s/article/SA-2021-12-02 MitigationPatchVendor Advisory
- http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529 US Government Resource
CPE matches (NVD) (2)
cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:*:*:*:*:*:*:*:*≤ 4.5cpe:2.3:a:ivanti:endpoint_manager_cloud_services_appliance:4.6:-:*:*:*:*:*:*