by Kastro
Paper/Archive/CVE-2023-39335

CVE-2023-39335

Ivanti EPMM — A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.1.831 × 2016.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potential misuse of user accounts and resources.

Affected

ProductAffectedFixed inSource
EPMM11.10.0.0 – 11.10.0.0–CNA
EPMM11.9.0.0 – 11.9.0.0–CNA
EPMM11.8.0.0 – 11.8.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/CVE-2023-39335?language=en_US