CVE-2023-28323

CVSS 9.8 CRITICALEPSS 3.1%CWE-502

Vexday Risk Score

28Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 9.8EPSS 3.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 jun 2023Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Productos afectados

Ivanti · Ivanti Endpoint Manager

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-28323