Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-28324
CVE-2023-28324:
Ivanti Endpoint Manager vulnerability analysis and mitigation
Overview
A critical improper input validation vulnerability (CVE-2023-28324) exists in Ivanti Endpoint Manager (EPM) 2022 and below. The vulnerability was disclosed on June 7th, 2023, affecting the AgentPortal service component. This vulnerability has received a CVSS v3.1 base score of 9.8 (CRITICAL), indicating its severe nature (NVD).
Technical details
The vulnerability exists in the AgentPortal.exe service, which is a .NET binary located at C:\Program Files\LanDesk\ManagementSuite\AgentPortal.exe. The service creates a .NET Remoting interface that allows for remote code execution through improper input validation. The vulnerability specifically exists in the ProcessRunProgramAction handler, which provides an attacker with the ability to execute arbitrary programs (Horizon3).
Impact
The vulnerability allows an attacker to achieve remote code execution (RCE) with SYSTEM privileges on affected systems. This level of access enables complete system compromise, allowing attackers to execute arbitrary commands with the highest privileges (NVD).
Mitigation and workarounds
The vulnerability has been patched in EPM 2021.1 SU4 and EPM 2022 SU2. The fix restricts the programs that can be executed through ProcessRunProgramAction to only ping.exe and tracert.exe. Organizations are strongly advised to update to these patched versions (Horizon3).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management