{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-35084", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2023-06-13T01:00:11.784Z", "datePublished": "2023-10-18T03:52:06.581Z", "dateUpdated": "2024-09-13T15:00:03.906Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely."}], "affected": [{"defaultStatus": "affected", "vendor": "Ivanti", "product": "Endpoint Manager", "versions": [{"version": "2022 su3", "status": "unaffected", "lessThan": "2022 su3", "versionType": "custom"}]}], "references": [{"url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2023-10-18T03:52:06.581Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:23:59.084Z"}, "title": "CVE Program Container", "references": [{"url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-13T14:59:52.715611Z", "id": "CVE-2023-35084", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-13T15:00:03.906Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:23:59.084Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-35084", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-13T14:59:52.715611Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-13T14:59:59.337Z"}}], "cna": {"affected": [{"vendor": "Ivanti", "product": "Endpoint Manager", "versions": [{"status": "unaffected", "version": "2022 su3", "lessThan": "2022 su3", "versionType": "custom"}], "defaultStatus": "affected"}], "references": [{"url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US"}], "descriptions": [{"lang": "en", "value": "Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2023-10-18T03:52:06.581Z"}}}, "cveMetadata": {"cveId": "CVE-2023-35084", "state": "PUBLISHED", "dateUpdated": "2024-09-13T15:00:03.906Z", "dateReserved": "2023-06-13T01:00:11.784Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2023-10-18T03:52:06.581Z", "assignerShortName": "hackerone"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "B1F6549B-CF5D-4607-B67D-5489905A1705", "versionEndExcluding": "2022", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*", "matchCriteriaId": "46580865-5177-4E55-BDAC-73DA4B472B35", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*", "matchCriteriaId": "E57E12B5-B789-450C-9476-6C4C151E6993", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*", "matchCriteriaId": "E47C65B3-56DD-4D65-8B4B-6AFFE28E94F2", "vulnerable": true}, {"criteria": "cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*", "matchCriteriaId": "10D6EAB7-B14B-45E9-92B9-4FADFBBB08AF", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely."}, {"lang": "es", "value": "La Deserializaci\u00f3n Insegura de la Entrada del Usuario podr\u00eda provocar la ejecuci\u00f3n de operaciones no autorizadas en Ivanti Endpoint Manager 2022 su3 y todas las versiones anteriores, lo que podr\u00eda permitir a un atacante ejecutar comandos de forma remota."}], "id": "CVE-2023-35084", "lastModified": "2024-11-21T08:07:56.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-18T04:15:11.027", "references": [{"source": "support@hackerone.com", "tags": ["Vendor Advisory"], "url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}