VYPR
← All advisories
High severity7.5NVD Advisory· Published Sep 21, 2023· Updated Jun 17, 2026

CVE-2023-38343

CVE-2023-38343

Description

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Affected products

7
  • Ivanti/Endpoint Manager6 versions
    cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*range: <2022
    • cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*
    • cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*
    • (no CPE)range: <2022 SU4
  • Ivanti/Endpoint Manager Mobilecpe-rescue

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.