9.9
Critical
CVE-2023-46808 An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to…
Description
An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ITSM | 2023.3 | No fix stated |
| neurons_for_itsm 2023.4 | earliest → < 2023.4 | 2023.4 |
Other CVEs of ITSM
The 5 CVEs of ITSM →
CVE-2024-7570
Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a…
8.3
High
CVE-2024-7569
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows…
9.6
Critical
CVE-2024-22059
A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to…
8.8
High
CVE-2024-22060
An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated,…
8.7
High