CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Aug 21, 2023

High

CISA KEV

CVE-2023-35081

Ivanti—Endpoint Manager Mobile (EPMM)

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

Required Action

https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

Vulnerability Overview

Severity: High
CISA KEV: Yes
Ransomware: Unknown
Published: Jul 31, 2023
KEV Added: Jul 31, 2023
Due Date: Aug 21, 2023
Related Articles: 0

Vendor

Ivanti

Endpoint Manager Mobile (EPMM)