CVE-2023-35084: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

Unsafe Deserialization of User Input vulnerability (CVE-2023-35084) was identified in Ivanti Endpoint Manager (EPM) 2022 SU3 and all previous versions. The vulnerability was discovered and disclosed in August 2023, affecting the Core server component of Ivanti EPM (NVD).

The vulnerability is characterized by unsafe deserialization of user input that could lead to execution of unauthorized operations. It has received a Critical CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating the highest severity level. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) (NVD).

The exploitation of CVE-2023-35084 allows an unauthenticated attacker with network access to the Core server to remotely read and exfiltrate files, which could expose sensitive information. The critical severity score indicates potential for complete compromise of system confidentiality, integrity, and availability (Ivanti Blog).

Ivanti has released patches to address this vulnerability. A fix is available in EPM 2022 Service Update 4 and the 2021.1 Service Release 5. Users of affected versions are strongly recommended to upgrade to the patched versions to prevent potential exploitation (Ivanti Blog).