Lucene search

K
nvd[email protected]NVD:CVE-2023-39335
HistoryNov 15, 2023 - 12:15 a.m.

CVE-2023-39335

2023-11-1500:15:08
web.nvd.nist.gov
cve-2023-39335
epmm versions
unauthorized access
user impersonation
device enrollment

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

39.3%

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potential misuse of user accounts and resources.

Affected configurations

NVD
Node
ivantiendpoint_manager_mobileRange<11.9.0
OR
ivantiendpoint_manager_mobileRange11.10.011.10.0.4
OR
ivantiendpoint_manager_mobileRange11.11.011.11.0.2

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

39.3%

Related for NVD:CVE-2023-39335