Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-07-31
• EPSS: 64% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.

CISA: Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 21 Aug 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-WriteVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource