Medium severity · published May 22, 2024
CVE-2023-46807
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database
6.7
CVSS
1.1%
EPSS
No
On KEV
Description
An SQL Injection vulnerability in web component of EPMM before 12.1.0.0 allows an authenticated user with appropriate privilege to access or modify data in the underlying database.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endpoint Manager Mobile · Ivanti
before 12.1.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46807
Vendor Advisory
https://forums.ivanti.com/s/article/Security-Advisory-EPMM-May-2024?language=en_US
More from Endpoint Manager Mobile
9.8
CVE-2026-1340
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2026-1281
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
9.8
CVE-2023-35082
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
9.8
CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
8.8
CVE-2025-4428
Remote Code Execution