VulnerabilityModified
CVE-2023-38343
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4.
HIGH 7.5EPSS 1.45%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- ivanti/endpoint manager
- Source
- cve@mitre.org
References
- https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928Third Party Advisory
- https://www.ivanti.com/releasesRelease Notes
- https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928Third Party Advisory
- https://www.ivanti.com/releasesRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.