CVE-2023-39336

2024-01-0901:33:05

hackerone

www.cve.org

ivanti endpoint manager

sql injection

arbitrary sql queries

internal network

authentication

rce

cve-2023-39336

9.6 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.8%

JSON

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.

CNA Affected

[
  {
    "defaultStatus": "affected",
    "vendor": "Ivanti",
    "product": "Endpoint Manager",
    "versions": [
      {
        "version": "2022 SU 5",
        "status": "unaffected",
        "lessThan": "2022 SU 5",
        "versionType": "semver"
      }
    ]
  }
]