Unscored CVE-2023-38343 EUVD-2023-42160GHSA-rfx9-vc4c-6rwm

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External enti…

Published Sep 21, 2023 · Updated Sep 24, 2024 · Assigned by mitre

Description

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Advisories 1

WID-SEC-2023-2421 Ivanti Endpoint Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 9, 2023

References

https://www.ivanti.com/releases
https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928