High severity · published Sep 21, 2023
CVE-2023-38343
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4
7.5
CVSS
2.1%
EPSS
No
On KEV
Description
An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager · Ivanti
before 2022; 2022; 2022; 2022; 2022 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38343
Third Party Advisory
https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928
Release Notes
https://www.ivanti.com/releases
More from Endpoint Manager
8.8
CVE-2024-29824
Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
7.5
CVE-2026-1603
Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
7.5
CVE-2024-13159
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13160
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability
7.5
CVE-2024-13161
Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability