Lucene search

[email protected]CVE-2023-28324

HistoryJul 01, 2023 - 12:15 a.m.

CVE-2023-28324

2023-07-0100:15:10

CWE-20

[email protected]

web.nvd.nist.gov

cve-2023-28324

improper input validation

ivanti endpoint manager

privilege escalation

remote code execution

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.9%

JSON

A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.

Affected configurations

NVD

Node

ivantiendpoint_managerRange≤2022

CPENameOperatorVersion
ivanti:endpoint_managerivanti endpoint managerle2022

CPE	Name	Operator	Version
ivanti:endpoint_manager	ivanti endpoint manager	le	2022

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Ivanti Endpoint Manager",
    "versions": [
      {
        "version": "2022",
        "status": "affected",
        "lessThanOrEqual": "2022",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.9%

JSON

Related for CVE-2023-28324

prion1 nvd1 cvelist1 nessus1