CVE-2024-29213 Privilege escalation in DSM

What is CVE-2024-29213?

CVE-2024-29213 is a high-severity vulnerability in Ivanti DSM, published on 18 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Ivanti DSM < version 2024.2 allows authenticated users on the local machine to run code with elevated privileges due to insecure ACL via unspecified attack vector.

Weakness: CWE-863

Which versions are affected by CVE-2024-29213?

It affects 1 product.

Products include Ivanti Desktop \& Server Management.

How do I fix CVE-2024-29213?

No fix has been published for CVE-2024-29213 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-29213 being exploited?

There is no known exploitation of CVE-2024-29213 in the wild and no public exploit code.

Other vulnerabilities in Ivanti DSM

• CVE-2024-38648 Hardcoded credentials in DSM Critical 9.0
• CVE-2026-3483 Privilege escalation in Desktop and Server Management High 7.8
• CVE-2024-29821 Privilege escalation in DSM High 7.8
• CVE-2023-28129 Command injection in Desktop & Server Management (DSM) High 7.8
• CVE-2024-7572 Missing authorization in Desktop and Server Management High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jr8x-r7fp-7rp4.