CVE-2023-39336

HIGH

8.8

Description

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published1/9/2024

Last Modified6/3/2025

Sourcenvd

Honeypot Sightings0

Affected Products

ivanti:endpoint_manager

Weaknesses (CWE)

CWE-89CWE-89

References

https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US(support@hackerone.com)

https://forums.ivanti.com/s/article/SA-2023-12-19-CVE-2023-39336?language=en_US(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.