PT-2023-26885 · Ivanti · Ivanti Endpoint Manager Mobile

Published 2023-11-13 · Updated 2024-08-29 · CVE-2023-39335

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile versions 11.10, 11.9, and 11.8 and older

Description A security issue has been identified that allows an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This poses a significant security risk, enabling unauthorized access and potential misuse of user accounts and resources.

Recommendations For versions 11.10, 11.9, and 11.8 and older, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-39335

Affected Products

Ivanti Endpoint Manager Mobile

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-39335 · Security Note
• https://forums.ivanti.com/s/article/CVE-2023-39335?language=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39335 · Vendor Advisory
• https://t.me/pentestingnews/41042 · Telegram Post
• https://t.me/latest_high_impact_cve/86 · Telegram Post
• https://t.me/cvenotify/92730 · Telegram Post