Veille CVE
CVE-2023-35081
7.2 Élevée Exploitée activementCatalogue CISA KEV — Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
Ajoutée le 31/07/2023 · Échéance de correction (agences US) : 21/08/2023
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.2 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.0 | 7.2 Élevée | support@hackerone.com | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US Vendor Advisory
- https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35081 US Government Resource