ByteOS Network

Vulnerability Details :

CVE-2025-22461

Assigner-ivanti

Assigner Org ID-3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Published At-08 Apr, 2025 | 14:26

Updated At-09 Apr, 2025 | 04:00

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:ivanti

Assigner Org ID:3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Published At:08 Apr, 2025 | 14:26

Updated At:09 Apr, 2025 | 04:00

▼CVE Numbering Authority (CNA)

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.

Affected Products

Vendor

Ivanti Software

Product

Endpoint Manager

Default Status

affected

Versions

Unaffected

2024 SU1 (custom)
2022 SU7 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-89	CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Type: CWE

CWE ID: CWE-89

Description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Metrics

Version	Base score	Base severity	Vector
3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Impacts

CAPEC ID	Description
CAPEC-66	CAPEC-66 SQL Injection

CAPEC ID: CAPEC-66

Description: CAPEC-66 SQL Injection

References

Hyperlink	Resource
https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6	N/A

Hyperlink: https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6

Resource: N/A

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Published At:08 Apr, 2025 | 15:15

Updated At:16 May, 2025 | 14:00

SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.