vulnerability
Ivanti EPMM/MobileIron Core: CVE-2023-35081: Remote Arbitrary File Write
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 9 | (AV:N/AC:M/Au:S/C:C/I:C/A:C) | Jul 28, 2023 | Jul 31, 2023 | Jul 31, 2023 |
Severity
9
CVSS
(AV:N/AC:M/Au:S/C:C/I:C/A:C)
Published
Jul 28, 2023
Added
Jul 31, 2023
Modified
Jul 31, 2023
Description
Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, through all supported versions (releases 11.10, 11.9 and 11.8) allows remote authenticated attackers to
perform arbitrary file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078, bypassing administrator authentication and ACLs restrictions.
Successful exploitation can be used to write malicious files to the appliance, ultimately allowing a malicious actor to execute OS commands on the appliance as the tomcat user.
Solution
ivantiepmm-cve-2023-35081
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.