Paper/Archive/CVE-2023-35084

CVE-2023-35084

Ivanti Endpoint Manager — Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previ…

EPSS 4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 90.1.901 × 2018.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.

Affected

ProductAffectedFixed inSource

Endpoint Managersee advisory2022 su3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US