At Ivanti, we are committed to delivering innovative, high quality and secure solutions for our customers. We collaborate with the broader security ecosystem to share intelligence and appreciate when we are made aware of issues via responsible disclosure from reputable sources.

There are two vulnerabilities we have recently discovered that impact Ivanti Endpoint Manager (EPM) versions 2022 and below. They both have CVSS scores in the ‘Moderate’ range. We are reporting them as CVE-2023-35083 and CVE-2023-35084.

Note: CVE-2023-38343 reported on 15 July 2023 is a duplicate of CVEs 35083 and 35084 rather than an additional vulnerability.

This vulnerability only impacts EPM. No other Ivanti products are affected, including Ivanti Endpoint Manager Mobile, formerly known as MobileIron.

Exploitation of CVE-2023-35083 allows an authenticated attacker to gain access to the server and read files, which could expose sensitive information.

Exploitation of CVE-2023-35084 allows an unauthenticated attacker with network access to the Core server to remotely read and exfiltrate files, which could expose sensitive information.

We have no evidence of any customers having been impacted by either vulnerability.

There are remediations for both vulnerabilities and a patch available now for EPM 2022 Service Update 4 and the upcoming 2021.1 Service Release 5.

More information and detailed instructions on how to remediate the vulnerability can be found in these Security Advisories:

Our Support team is always here to help our customers and partners should they have any questions. Cases can be logged via the Success portal (login credentials required).

Want to stay up to date on Ivanti Security Advisories? Paste https://www.ivanti.com/blog/topics/security-advisory/rss into your preferred RSS reader / functionality in your email program.