9.8

CVE-2023-28323

EPSS 3.15%
Veröffentlicht 01.07.2023 00:15:10
Zuletzt bearbeitet 05.05.2025 16:15:33
Erkennungen
Login

A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

NVD 5 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ivanti ≫ Endpoint Manager Version < 2022

Ivanti ≫ Endpoint Manager Version 2022 Update -

Ivanti ≫ Endpoint Manager Version 2022 Update su1

Ivanti ≫ Endpoint Manager Version 2022 Update su2

Ivanti ≫ Endpoint Manager Version 2022 Update su3

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	3.15%	0.864

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-28323

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28323

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28323

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28323

EUVD