7.2
High
Exploited
CVE-2023-35081 Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Ransomware campaigns
Not observed so far
Weakness
CWE-22
Description
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EPMM 11.10 | earliest → < 11.10.0.3 | 11.10.0.3 |
References
- forums.ivanti.com forums.ivanti.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of EPMM
The 11 CVEs of EPMM →
CVE-2024-36130
An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker…
9.8
Critical
CVE-2024-36131
An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote…
8.8
High
CVE-2024-34788
An improper authentication vulnerability in web component of EPMM prior to 12.1.0.1 allows a remote malicious user to…
5.3
Medium
CVE-2024-36132
Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass…
8.2
High