CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Aug 21, 2023

CVE-2023-35081

High

EPSS 91.0%CISA KEV

Ivanti/Endpoint Manager Mobile (EPMM)

Description

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

EPSS — Exploit Probability

91.0%

Higher than 99.6% of all CVEs

Required Action

https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

Risk Assessment

HIGH

In CISA KEV

High EPSS

Details

Severity: High
EPSS: 91.0%
CISA KEV: Yes
Ransomware: Unknown
Articles: 0

Timeline

Published

Jul 31, 2023

Added to KEV

Jul 31, 2023

Remediation Due

Aug 21, 2023

Affected Product

Ivanti

Endpoint Manager Mobile (EPMM)

View all Ivanti CVEs

External Links

NVD (NIST)CVE Details MITRE CVE