{"affected":[{"defaultStatus":"affected","product":"Endpoint Manager","source":"CNA: ivanti","vendor":"Ivanti","versions":[{"status":"unaffected","version":"2024 November Security Update","versionType":"custom"},{"status":"unaffected","version":"2022 SU6 November Security Update","versionType":"custom"}]},{"defaultStatus":"unknown","product":"endpoint_manager","source":"ADP: CISA-ADP","vendor":"ivanti","versions":[{"lessThan":"2024_november_security_update","status":"affected","version":"0","versionType":"custom"},{"lessThan":"2022_su6_november_security_update","status":"affected","version":"0","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"2022","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:su4:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2022:su5:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-50330","cwes":["CWE-89"],"description":"SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote unauthenticated attacker to achieve remote code execution.","epss":{"date":"2026-11-03","percentile":0.98643,"score":0.40287},"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: ivanti","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":9.8,"severity":"critical","source":"NVD: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793744246463,"publishedAt":1731426140786,"references":[{"source":"CNA: ivanti","tags":[],"url":"https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022"},{"source":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","tags":["Vendor Advisory"],"url":"https://forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM-2024-and-EPM-2022"}],"remediation":[],"revision":"81f78a48de5240f8b8992e59c9f2661e391fd7020b666b80fa98b9ea498f7c53","sources":[{"modifiedAt":1793742762715,"name":"CNA: ivanti","retrievedAt":1793744064825,"url":"https://www.cve.org/CVERecord?id=CVE-2024-50330"},{"modifiedAt":1793744246463,"name":"NVD","retrievedAt":1793751366228,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50330"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793744098785,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-50330"}],"ssvc":{"assessedAt":1731992170966,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"CVE-2024-50330","updatedAt":1793751366228}