CVE-2023-35081: high-severity vulnerability in Ivanti EPMM
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
An authenticated administrator can bypass file system restrictions in Ivanti EPMM and write files anywhere on the system. This allows them to place malicious files or modify critical system files, potentially taking complete control of the device.
Path traversal vulnerability in Ivanti EPMM (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2, 11.8.x < 11.8.1.2) permits authenticated administrators to write arbitrary files to the appliance via improper input validation on file path parameters. Exploitation requires valid administrator credentials and results in unauthorized file creation/modification with system privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.