PT-2023-26373 · Ivanti · Ivanti Endpoint Manager

Published 2023-09-21 · Updated 2023-09-25 · CVE-2023-38343

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2022 SU4

Description An XXE (XML external entity injection) vulnerability exists in the CSEP component. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Recommendations For versions prior to 2022 SU4, update to 2022 SU4 or later to resolve the issue. As a temporary workaround, consider disabling the XML parser configuration that enables external entity references until a patch is available. Restrict access to the CSEP component to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2023-38343

Affected Products

Ivanti Endpoint Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-38343 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38343 · Vendor Advisory
• https://t.me/cvenotify/58354 · Telegram Post
• https://ivanti.com/releases · Note
• https://twitter.com/CVEnew/status/1704967293128593583 · Twitter Post
• https://t.me/cvenotify/58566 · Telegram Post
• https://t.me/cibsecurity/70927 · Telegram Post
• https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928 · Note
• https://twitter.com/VulmonFeeds/status/1704988061250056633 · Twitter Post