CVE-2023-39337

Published: Nov 15, 2023Modified: Nov 21, 2024

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.

Affected (3)

Products: Ivanti: Endpoint Manager Mobile

Ivanti

1 product

Endpoint Manager Mobile

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Manager Mobile	Up to 11.9.0
Ivanti Endpoint Manager Mobile	From 11.10.0 to 11.10.0.4
Ivanti Endpoint Manager Mobile	From 11.11.0 to 11.11.0.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://forums.ivanti.com/s/article/CVE-2023-39337?language=en_US

Source: support@hackerone.com

Vendor Advisory

https://forums.ivanti.com/s/article/CVE-2023-39337?language=en_US

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.