CVEvulnerability

CVE-2023-35081

7.2 HIGH Known exploited Published 2023-08-03 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability — Ivanti Endpoint Manager Mobile (EPMM)

Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

Added to KEV: 2023-07-31
Remediation due: 2023-08-21
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

Status: Analyzed
Published: 2023-08-03
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0 ([email protected]): 7.2 HIGH — CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-22

Description

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.

Affected configurations

• ivanti endpoint manager mobile (>= 11.8.0 < 11.8.1.2) • ivanti endpoint manager mobile (>= 11.9.0 < 11.9.1.2) • ivanti endpoint manager mobile (>= 11.10.0 < 11.10.0.3)

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References