CVE-2023-39337
First published: Tue Nov 14 2023(Updated: )
A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ivanti Endpoint Manager Mobile | <=11.9.0 | |
| Ivanti Endpoint Manager Mobile | >=11.10.0<11.10.0.4 | |
| Ivanti Endpoint Manager Mobile | >=11.11.0<11.11.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-39337?
CVE-2023-39337 is a security vulnerability in EPMM Versions 11.10, 11.9, and 11.8 older that allows a threat actor with knowledge of an enrolled device identifier to access sensitive information.
What is the severity of CVE-2023-39337?
The severity of CVE-2023-39337 is critical with a CVSS score of 9.1.
What software versions are affected by CVE-2023-39337?
EPMM Versions 11.10, 11.9, and 11.8 older are affected by CVE-2023-39337.
What can a threat actor extract through CVE-2023-39337?
A threat actor can extract sensitive information, including device and environment configuration details, as well as secrets, through CVE-2023-39337.
Is there a reference link for more information on CVE-2023-39337?
Yes, you can find more information on CVE-2023-39337 [here](https://forums.ivanti.com/s/article/CVE-2023-39337?language=en_US).
- collector/mitre-cve
- collector/nvd-api
- vendor/ivanti
- product/endpoint manager mobile
- canonical/ivanti endpoint manager mobile