Lucene search

[email protected]CVE-2023-35084

HistoryOct 18, 2023 - 4:15 a.m.

CVE-2023-35084

2023-10-1804:15:11

CWE-502

[email protected]

web.nvd.nist.gov

cve-2023-35084

unsafe deserialization

user input

execution

unauthorized operations

ivanti endpoint manager

remote command execution

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.

Affected configurations

NVD

Node

ivantiendpoint_managerRange<2022

ivantiendpoint_managerMatch2022-

ivantiendpoint_managerMatch2022su1

ivantiendpoint_managerMatch2022su2

ivantiendpoint_managerMatch2022su3

CPENameOperatorVersion
ivanti:endpoint_managerivanti endpoint managerlt2022

CPE	Name	Operator	Version
ivanti:endpoint_manager	ivanti endpoint manager	lt	2022

CNA Affected

[
  {
    "defaultStatus": "affected",
    "vendor": "Ivanti",
    "product": "Endpoint Manager",
    "versions": [
      {
        "version": "2022 su3",
        "status": "unaffected",
        "lessThan": "2022 su3",
        "versionType": "custom"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.8%

JSON

Related for CVE-2023-35084

cvelist1 prion1 nvd1