Lucene search

[email protected]CVE-2023-38343

HistorySep 21, 2023 - 9:15 p.m.

CVE-2023-38343

2023-09-2121:15:09

CWE-611

[email protected]

web.nvd.nist.gov

cve-2023-38343

xxe

xml external entity injection

ivanti endpoint manager

file disclosure

ssrf

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.3%

JSON

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Affected configurations

NVD

Node

ivantiendpoint_managerRange<2022

ivantiendpoint_managerMatch2022-

ivantiendpoint_managerMatch2022su1

ivantiendpoint_managerMatch2022su2

ivantiendpoint_managerMatch2022su3

CPENameOperatorVersion
ivanti:endpoint_managerivanti endpoint managerlt2022

CPE	Name	Operator	Version
ivanti:endpoint_manager	ivanti endpoint manager	lt	2022

References

gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928

www.ivanti.com/releases

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.3%

JSON

Related for CVE-2023-38343

nvd1 prion1 cvelist1