SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8?language=en_US | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
11 Jul 2025, 17:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Ivanti endpoint Manager
Ivanti |
|
| CPE | cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su8:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su7:*:*:*:*:*:* cpe:2.3:a:ivanti:endpoint_manager:2022:su6:*:*:*:*:*:* |
|
| References | () https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8?language=en_US - Vendor Advisory |
08 Jul 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-08 15:15
Updated : 2025-07-11 17:24
NVD link : CVE-2025-7037
Mitre link : CVE-2025-7037
JSON object : View
Products Affected
ivanti
- endpoint_manager
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')