PT-2023-26373 · Ivanti · Ivanti Endpoint Manager

Publicado 2023-09-21 · Atualizado 2023-09-25 · CVE-2023-38343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2022 SU4

Description An XXE (XML external entity injection) vulnerability exists in the CSEP component. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Recommendations For versions prior to 2022 SU4, update to 2022 SU4 or later to resolve the issue. As a temporary workaround, consider disabling the XML parser configuration that enables external entity references until a patch is available. Restrict access to the CSEP component to minimize the risk of exploitation.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2023-38343

Produtos afetados

Ivanti Endpoint Manager

Referências · 9

• https://t.me/cvenotify/58354 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38343 · Nota de Segurança
• https://ivanti.com/releases · Nota
• https://twitter.com/CVEnew/status/1704967293128593583 · Publicação no Twitter
• https://t.me/cvenotify/58566 · Publicação no Telegram
• https://t.me/cibsecurity/70927 · Publicação no Telegram
• https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928 · Nota
• https://osv.dev/vulnerability/CVE-2023-38343 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1704988061250056633 · Publicação no Twitter