CVE-2024-50322: Path Traversal in Ivanti Endpoint Manager

The impact of this vulnerability is significant due to the potential for code execution. An attacker with local access to a system running vulnerable Ivanti Endpoint Manager can exploit this flaw to gain complete control over the endpoint. This could involve installing malware, stealing sensitive data, or pivoting to other systems on the network. The requirement for user interaction means that attackers may need to trick users into clicking malicious links or opening compromised files, but the potential for widespread compromise remains high. Given Endpoint Manager's role in managing and deploying software, a successful exploit could allow attackers to inject malicious code into updates or installations, affecting a large number of endpoints.

1. Reserved2024-10-22
2. Published2024-11-12
3. Modified2024-11-19
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-50322 is to upgrade to the 2024 November Security Update or 2022 SU6 November Security Update. If immediate patching is not possible, consider restricting local access to the Endpoint Manager server and implementing strict user awareness training to minimize the risk of user interaction. While a direct workaround is not available, monitoring for unusual file access patterns and suspicious processes can help detect potential exploitation attempts. After upgrade, confirm successful remediation by attempting to trigger the vulnerable path traversal sequence and verifying that access is denied.