The vulnerability of the Ivanti Endpoint Manager Mobile (EPMM) application for managing the lifecycle of mobile devices and mobile applications (formerly known as MobileIron Core) lies in the improper restriction of the path name to the restricted directory. This allows a malicious user to write arbitrary files.

🗓️ 08 Aug 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Ivanti Endpoint Manager Mobile vulnerability allows arbitrary file writes from improper restricted directory path.

Reporter	Title	Published	Views	Family All 32
ICS	Threat Actors Exploiting Ivanti EPMM Vulnerabilities	1 Aug 202312:00	–	ics
ATTACKERKB	CVE-2023-35081	3 Aug 202300:00	–	attackerkb
Circl	CVE-2023-35081	29 Jul 202306:39	–	circl
CISA KEV Catalog	Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability	31 Jul 202300:00	–	cisa_kev
CISA	Ivanti Releases Security Updates for EPMM to address CVE-2023-35081	2 Aug 202312:00	–	cisa
CISA	CISA and International Partner NCSC-NO Release Joint Cybersecurity Advisory on Threat Actors Exploiting Ivanti EPMM Vulnerabilities	1 Aug 202312:00	–	cisa
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	31 Jul 202312:00	–	cisa
CNNVD	Ivanti EPMM Path Traversal Vulnerability	3 Aug 202300:00	–	cnnvd
CVE	CVE-2023-35081	3 Aug 202317:00	–	cve
Cvelist	CVE-2023-35081	3 Aug 202317:00	–	cvelist

Vulners

Node

ivanti ivanti_endpoint_manager_mobileMatch11.10

OR

ivanti ivanti_endpoint_manager_mobileMatch11.9

OR

ivanti ivanti_endpoint_manager_mobileMatch11.8

Source	Link
forums	www.forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write
cisa	www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv
web	www.web.nvd.nist.gov/view/vuln/detail

24 Sep 2024 00:00Current

7.7High risk

Vulners AI Score7.7

CVSS 37.2

CVSS 28.3

EPSS0.63316

Ivanti Endpoint Manager Mobile Former MobileIron Core Path restriction Arbitrary file write