CVE-2024-10256

Published: Dec 10, 2024Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.

Affected (13)

Products: Ivanti: Endpoint Manager, Neurons Agent Platform, Neurons For Patch Management, Patch For Configuration Manager, Patch Software Development Kit, Security Controls

6 products

Endpoint Manager

Neurons Agent Platform

Neurons For Patch Management

Patch For Configuration Manager

Patch Software Development Kit

Security Controls

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Manager	Version 2022
Ivanti Endpoint Manager	Version 2022 su1
Ivanti Endpoint Manager	Version 2022 su2
Ivanti Endpoint Manager	Version 2022 su3
Ivanti Endpoint Manager	Version 2022 su4
Ivanti Endpoint Manager	Version 2022 su5
Ivanti Endpoint Manager	Version 2022 su6
Ivanti Endpoint Manager	Version 2024
Ivanti Neurons Agent Platform	version < 2024.4
Ivanti Neurons For Patch Management	version < 2024.4
Ivanti Patch For Configuration Manager	version < 2024.4
Ivanti Patch Software Development Kit	version < 9.7.703
Ivanti Security Controls	version < 2024.4

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

MitigationVendor Advisory

Timeline

No history available yet.