CVE-2023-39337

2023-11-1423:18:08

hackerone

www.cve.org

security vulnerability

epmm versions

threat actor

sensitive information

confidential data

system integrity

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "EPMM",
    "versions": [
      {
        "version": "11.10.0.0",
        "status": "affected",
        "lessThanOrEqual": "11.10.0.0",
        "versionType": "semver"
      },
      {
        "version": "11.9.0.0",
        "status": "affected",
        "lessThanOrEqual": "11.9.0.0",
        "versionType": "semver"
      },
      {
        "version": "11.8.0.0",
        "status": "affected",
        "lessThanOrEqual": "11.8.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

forums.ivanti.com/s/article/CVE-2023-39337?language=en_US