CVE-2023-35081
KEVIvanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
View CVE record →- Vendor / Project
- Ivanti
- Product
- Endpoint Manager Mobile (EPMM)
- Date added
- Jul 31, 2023
- Due date
- Aug 21, 2023
- Known ransomware use
- Unknown
- CWEs
- CWE-22
Description
Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.