CVEvulnerability

CVE-2023-39335

9.8 CRITICAL Published 2023-11-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-11-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269

Description

A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existing user during the device enrollment process. This issue poses a significant security risk, as it enables unauthorized access and potential misuse of user accounts and resources.

Affected configurations

• ivanti endpoint manager mobile (< 11.9.0) • ivanti endpoint manager mobile (>= 11.10.0 < 11.10.0.4) • ivanti endpoint manager mobile (>= 11.11.0 < 11.11.0.2)

Related

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References