CVE-2023-35083 : Allows an authenticated attacker with network access to read arbitrary files on

Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all previous versions potentially leading to the leakage of sensitive information.

Published 2023-10-18 04:15:11

Updated 2023-10-25 00:14:42

Source HackerOne

View at NVD, CVE.org

Products affected by CVE-2023-35083

Ivanti » Endpoint Manager
Versions before (<) 2022
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
Matching versions
Ivanti » Endpoint Manager » Version: 2022 Update SU1
cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*
Matching versions
Ivanti » Endpoint Manager » Version: 2022
cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*
Matching versions
Ivanti » Endpoint Manager » Version: 2022 Update SU2
cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*
Matching versions
Ivanti » Endpoint Manager » Version: 2022 Update SU3
cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-35083

EPSS FAQ

6.86%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-35083

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2023-35083

https://forums.ivanti.com/s/article/SA-2023-06-20-CVE-2023-35083?language=en_US

SA-2023-08-08-CVE-2023-35083
Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-35083

Products affected by CVE-2023-35083

Exploit prediction scoring system (EPSS) score for CVE-2023-35083

CVSS scores for CVE-2023-35083

References for CVE-2023-35083