PT-2023-26374 · Ivanti · Ivanti Endpoint Manager

Published 2023-09-21 · Updated 2024-09-25 · CVE-2023-38344

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2022 SU4

Description A file disclosure issue exists in the GetFileContents SOAP action exposed via "/landesk/managementsuite/core/core.secure/OsdScript.asmx". The application does not sufficiently restrict user-supplied paths, allowing an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access.

Recommendations For Ivanti Endpoint Manager versions prior to 2022 SU4, update to version 2022 SU4 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/landesk/managementsuite/core/core.secure/OsdScript.asmx" endpoint and the GetFileContents SOAP action to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-38344

Affected Products

Ivanti Endpoint Manager

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-38344 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38344 · Vendor Advisory
• https://ivanti.com/releases · Note
• https://t.me/cvenotify/58353 · Telegram Post
• https://twitter.com/CVEnew/status/1704967294269460603 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704988314304946666 · Twitter Post
• https://t.me/cvenotify/58564 · Telegram Post
• https://gist.github.com/bhyahoo/76533e91840200a1d9f3fb1eb87eb0f1 · Note
• https://t.me/cibsecurity/70929 · Telegram Post