Riskcovery

CVE-2025-7037

SQL injection in Ivanti Endpoint Manager

State
Published
Severity
7.2 High
Published
Jul 8, 2025
Updated
Jul 8, 2025
Reserved
Jul 2, 2025

Read the record on cve.org

Description

SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to read arbitrary data from the database

Scores

CVSSScoreVectorSource
3.17.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hivanti

Weaknesses

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

ProductVersions
Endpoint ManagerIvanti
  • 2024 SU3Not affected
  • 2022 SU8Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.