Medium WID-SEC-2023-2421 4 CVEs

Ivanti Endpoint Manager: Mehrere Schwachstellen

Published Sep 21, 2023 · Updated Oct 9, 2023 · Revision 2 · de-DE

Vendor: ivanti Product: Endpoint Manager < 2022 SU4 Platform: Linux Platform: macOS Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager ausnutzen, um Informationen offenzulegen oder einen Server Side Request Forgery-Angriff durchzuführen.

Product

Ivanti Endpoint Manager ist eine Endpoint Management Software zur zentralen Verwaltung von Benutzerprofilen und -Geräten.

Vulnerabilities 4

Unscored —

CVE-2023-35083

Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on…

ivanti Endpoint Manager Network devices

Oct 18, 2023
Unscored —

CVE-2023-35084

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022…

ivanti Endpoint Manager Network devices

Oct 18, 2023
Unscored —

CVE-2023-38343

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 202…

Sep 21, 2023
Unscored —

CVE-2023-38344

An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFi…

Sep 21, 2023

Revision history

2023-10-09 #2
CVE Nummern ergänzt
2023-09-21 #1
Initiale Fassung

References

Ivanti Security Advisory vom 2023-09-21
https://github.com/advisories/GHSA-vhfm-hcpf-g55q
Ivanti Security Advisory vom 2023-09-21
https://github.com/advisories/GHSA-rfx9-vc4c-6rwm