What’s Vulnerable › Vulnerabilities

CVE-2023-38343

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-21 · updated 2026-06-17
• Weakness: CWE-611

Description

An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. External entity references are enabled in the XML parser configuration. Exploitation of this vulnerability can lead to file disclosure or Server Side Request Forgery.

Affected products

• Ivanti Endpoint Manager: before 2022; 2022, 2022-su1, 2022-su2, 2022-su3 — fixed in 2022

How to fix

Upgrade to a fixed version: Ivanti Endpoint Manager 2022. Check the vendor advisory for mitigations.

References

• https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928
• https://www.ivanti.com/releases
• https://gist.github.com/bhyahoo/4772330b20057a271f77e690bc70f928
• https://www.ivanti.com/releases

Get alerted when CVE-2023-38343 or the next vulnerability affects your stack