CVE-2023-38343
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Attend
*SSVC
Descriptions
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.
Existe una vulnerabilidad XXE (inyección de entidad externa XML) en el componente CSEP de Ivanti Endpoint Manager antes de 2022 SU4. Las referencias a entidades externas están habilitadas en la configuración del analizador XML. La explotación de esta vulnerabilidad puede provocar la divulgación de archivos o Server Side Request Forgery.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Attend
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-07-15 CVE Reserved
- 2023-09-21 CVE Published
- 2024-09-24 CVE Updated
- 2024-10-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928 | Third Party Advisory | |
| https://www.ivanti.com/releases | Release Notes |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ivanti Search vendor "Ivanti" | Endpoint Manager Search vendor "Ivanti" for product "Endpoint Manager" | < 2022 Search vendor "Ivanti" for product "Endpoint Manager" and version " < 2022" | - |
Affected
| ||||||
| Ivanti Search vendor "Ivanti" | Endpoint Manager Search vendor "Ivanti" for product "Endpoint Manager" | 2022 Search vendor "Ivanti" for product "Endpoint Manager" and version "2022" | - |
Affected
| ||||||
| Ivanti Search vendor "Ivanti" | Endpoint Manager Search vendor "Ivanti" for product "Endpoint Manager" | 2022 Search vendor "Ivanti" for product "Endpoint Manager" and version "2022" | su1 |
Affected
| ||||||
| Ivanti Search vendor "Ivanti" | Endpoint Manager Search vendor "Ivanti" for product "Endpoint Manager" | 2022 Search vendor "Ivanti" for product "Endpoint Manager" and version "2022" | su2 |
Affected
| ||||||
| Ivanti Search vendor "Ivanti" | Endpoint Manager Search vendor "Ivanti" for product "Endpoint Manager" | 2022 Search vendor "Ivanti" for product "Endpoint Manager" and version "2022" | su3 |
Affected
| ||||||