by Kastro
Paper/Archive/CVE-2023-39336

CVE-2023-39336

Ivanti Endpoint Manager — An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the…

EPSS 10%CVSS 9.6
critical.is priorityof 100
48
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 95.6.956 × 2019.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.

Affected

ProductAffectedFixed inSource
Endpoint Managersee advisory2022 SU 5CNA

Scores by source

hackerone (CNA)9.6CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US