Actively exploited · Published Aug 3, 2023 · Assigned by hackerone
CVE-2023-35081
High 7.2 Exploited
In plain English
A high-severity path traversal in EPMM from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on July 31, 2023). The chance it is exploited in the next 30 days is estimated at 63.6% (higher than 99.2% of all known vulnerabilities). Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 21, 2023.
Official description
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H