CVE-2023-28324

2023-07-0100:15:10

CWE-20

hackerone

web.nvd.nist.gov

cve-2023-28324

improper input validation

ivanti endpoint manager

privilege escalation

remote code execution

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

70.5%

JSON

A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution.

Affected configurations

Nvd

Node

ivantiendpoint_managerRange≤2022

VendorProductVersionCPE
ivantiendpoint_manager*cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ivanti	endpoint_manager	*	cpe:2.3:a:ivanti:endpoint_manager::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "Ivanti Endpoint Manager",
    "versions": [
      {
        "version": "2022",
        "status": "affected",
        "lessThanOrEqual": "2022",
        "versionType": "semver"
      }
    ]
  }
]