CVE-2023-39337

CRITICAL

Ivanti Endpoint Manager Mobile < 11.9.0 - Sensitive Information Exposure via Device Identifier

Title source: llm

Description

A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extract sensitive information, including device and environment configuration details, as well as secrets. This vulnerability poses a serious security risk, potentially exposing confidential data and system integrity.

References (1)

Core 1

Core References

Vendor Advisory

https://forums.ivanti.com/s/article/CVE-2023-39337?language=en_US

Scores

CVSS v3 9.1

EPSS 0.0155

EPSS Percentile 81.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-200

Status published

Products (1)

ivanti/endpoint_manager_mobile < 11.9.0

Published Nov 15, 2023

Tracked Since Feb 18, 2026