CVE-2023-46808

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.

Score

CVSS 3.1 9.9 Critical

Status

Modified - support@hackerone.com

Published

2024-03-31

Last modified

2024-08-02

Weaknesses

CWE-434

Affected products

• Itsm (Ivanti)
• Neurons For Itsm (Ivanti)

References

• https://forums.ivanti.com/s/article/SA-CVE-2023-46808-Authenticated-Remote-File-Write-for-Ivanti-Neurons-for-ITSM