Vulnerability · Published Dec 5, 2022 · Assigned by hackerone
CVE-2022-27773
Critical 9.8
In plain English
A critical-severity incorrect default permissions in Ivanti Endpoint Manger. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)2.8%top 13.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Ivanti Endpoint Manger | Fixed version: 2021.1 SU3 or above, on 2022 SU2 or above |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H