CVSS: 7.2EPSS: 80%CPEs: 3EXPL: 0CVE-2023-35081 – Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
https://notcve.org/view.php?id=CVE-2023-35081
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance. Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable). • https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 96%CPEs: 1EXPL: 7CVE-2023-35078 – Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2023-35078
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices. • https://github.com/vchan-in/CVE-2023-35078-Exploit-POC https://github.com/raytheon0x21/CVE-2023-35078 https://github.com/emanueldosreis/nmap-CVE-2023-35078-Exploit https://github.com/lager1/CVE-2023-35078 https://github.com/0nsec/CVE-2023-35078 https://github.com/Blue-number/CVE-2023-35078 https://github.com/synfinner/CVE-2023-35078 https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability https://forums.ivanti.com/s/article/KB-Remote-un • CWE-287: Improper Authentication •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-35077
https://notcve.org/view.php?id=CVE-2023-35077
An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above. • https://forums.ivanti.com/s/article/SA-2023-07-19-CVE-2023-35077 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2023-28323 – Ivanti Endpoint Manager ProcessEPMAuthToken Deserialization of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-28323
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ProcessEPMAuthToken method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. • https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-28323 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-28324
https://notcve.org/view.php?id=CVE-2023-28324
A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. • https://github.com/horizon3ai/CVE-2023-28324 https://forums.ivanti.com/s/article/SA-2023-06-06-CVE-2023-28324 • CWE-20: Improper Input Validation •