Lucene search
PRIOn knowledge basePRION:CVE-2023-38344HistorySep 21, 2023 - 9:15 p.m.
Arbitrary file deletion
2023-09-2121:15:00
PRIOn knowledge base
www.prio-n.com
6
ivanti endpoint manager
file disclosure
getfilecontents soap action
osdscript.asmx
user-supplied paths
authenticated attacker
remote access
An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access.
| CPE | Name | Operator | Version |
|---|---|---|---|
| endpoint_manager | eq | 2022 su1 | |
| endpoint_manager | lt | 2022 | |
| endpoint_manager | eq | 2022 | |
| endpoint_manager | eq | 2022 su2 | |
| endpoint_manager | eq | 2022 su3 |
Related
cvelist
cvelist
CVE-2023-38344
2023-09-21 00:00:00
nvd
nvd
CVE-2023-38344
2023-09-21 21:15:10
cve
cve
CVE-2023-38344
2023-09-21 21:15:10