CVE-2023-28323
Last modified
CVE-2023-28323 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines. . EPSS estimates a 3.12% chance of exploitation in the next 30 days.
Description
A deserialization of untrusted data exists in EPM 2022 Su3 and all prior versions that allows an unauthenticated user to elevate rights. This exploit could potentially be used in conjunction with other OS (Operating System) vulnerabilities to escalate privileges on the machine or be used as a stepping stone to get to other network attached machines.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ivanti | Endpoint Manager | < 2022 |
| Ivanti | Endpoint Manager | 2022 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28323?
How severe is CVE-2023-28323?
How do I fix CVE-2023-28323?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-28318A vulnerability has been discovered in Rocket.Chat, where me…5.3
- CVE-2023-28319A use after free vulnerability exists in curl <v8.1.0 in the…7.5
- CVE-2023-2832 SQL Injection in GitHub repository unilogies/bumsys prior t…7.2
- CVE-2023-28320A denial of service vulnerability exists in curl <v8.1.0 in …5.9
- CVE-2023-28321An improper certificate validation vulnerability exists in c…5.9
- CVE-2023-28322An information disclosure vulnerability exists in curl <v8.1…3.7
- CVE-2023-28324A improper input validation vulnerability exists in Ivanti E…9.8
- CVE-2023-28325An improper authorization vulnerability exists in Rocket.Cha…6.5
- CVE-2023-28326Vendor: The Apache Software Foundation Versions Affected: A…9.8
- CVE-2023-28327A NULL pointer dereference flaw was found in the UNIX protoc…5.5
- CVE-2023-28328A NULL pointer dereference flaw was found in the az6027 driv…5.5
- CVE-2023-28329Insufficient validation of profile field availability condit…8.8
Are you affected by CVE-2023-28323?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST