CVE-2024-10256

Published: Dec 10, 2024Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 (Secondary)

Description

Insufficient permissions in Ivanti Patch SDK before version 9.7.703 allows a local authenticated attacker to delete arbitrary files.

Affected (13)

Products: Ivanti: Endpoint Manager, Neurons Agent Platform, Neurons For Patch Management, Patch For Configuration Manager, Patch Software Development Kit, Security Controls

6 products

Endpoint Manager

Neurons Agent Platform

Neurons For Patch Management

Patch For Configuration Manager

Patch Software Development Kit

Security Controls

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Manager	Version 2022
Ivanti Endpoint Manager	Version 2022 su1
Ivanti Endpoint Manager	Version 2022 su2
Ivanti Endpoint Manager	Version 2022 su3
Ivanti Endpoint Manager	Version 2022 su4
Ivanti Endpoint Manager	Version 2022 su5
Ivanti Endpoint Manager	Version 2022 su6
Ivanti Endpoint Manager	Version 2024
Ivanti Neurons Agent Platform	Before 2024.4
Ivanti Neurons For Patch Management	Before 2024.4
Ivanti Patch For Configuration Manager	Before 2024.4
Ivanti Patch Software Development Kit	Before 9.7.703
Ivanti Security Controls	Before 2024.4

Related CWEs

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Patch-SDK-CVE-2024-10256

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

MitigationVendor Advisory

Timeline

No history available yet.