CVE-2023-35077 - Vulnerability Details - OpenCVE

ReportizFlow

An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ivanti	Endpoint Manager
Microsoft	Windows

Configuration 1 [-]

AND

cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://forums.ivanti.com/s/article/SA-2023-07-19-CVE-2023-35077

History

Thu, 24 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2023-07-21T20:51:29.385Z

Updated: 2024-10-24T15:55:30.239Z

Reserved: 2023-06-13T01:00:11.783Z

Link: CVE-2023-35077

Vulnrichment

Updated: 2024-08-02T16:23:57.606Z

NVD

Status : Modified

Published: 2023-07-21T21:15:11.337

Modified: 2026-06-17T06:04:23.240

Link: CVE-2023-35077

Redhat

No data.

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Endpoint Manager", "vendor": "Ivanti", "versions": [{"lessThan": "7.9.1.285", "status": "affected", "version": "7.9.1.285", "versionType": "custom"}]}], "source": "[email protected]"}, {"affectedData": [{"cpes": ["cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "endpoint_manager", "vendor": "ivanti", "versions": [{"lessThan": "7.9.1.285", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "2AA8C7A8-3B85-406F-A240-BCDE37C5242C", "versionEndExcluding": "7.9.1.285", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. Update to Ivanti AV Product version 7.9.1.285 or above."}], "id": "CVE-2023-35077", "lastModified": "2026-06-17T06:04:23.240", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-35077", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-24T15:54:38.305737Z", "version": "2.0.3"}}]}, "published": "2023-07-21T21:15:11.337", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://forums.ivanti.com/s/article/SA-2023-07-19-CVE-2023-35077"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://forums.ivanti.com/s/article/SA-2023-07-19-CVE-2023-35077"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "[email protected]", "type": "Primary"}]}