The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the November 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: 

  - Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November     Security Update allows a local unauthenticated attacker to achieve code execution. User interaction is     required.  (CVE-2024-34787)

  - Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November     Security Update allows a remote unauthenticated attacker to achieve remote code execution. User     interaction is required. (CVE-2024-50329)   
  - SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November     Security Update allows a remote unauthenticated attacker to achieve remote code execution.     (CVE-2024-50330)

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number of the affected dll files.

Detections

Analytics

Ivanti Endpoint Manager 2024 - November 2024 Security Update

critical Nessus Plugin ID 211457

Version 1.5