CVE-2023-38344: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

A file disclosure vulnerability (CVE-2023-38344) was discovered in Ivanti Endpoint Manager versions before 2022 SU4. The vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The issue was publicly disclosed on September 21, 2023 (NVD).

The vulnerability stems from insufficient restrictions on user-supplied paths in the application. This security flaw has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability has been categorized under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) (NVD).

When exploited, this vulnerability allows an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access. This could potentially lead to unauthorized access to sensitive system information (NVD).

The vulnerability has been fixed in Ivanti Endpoint Manager 2022 SU4. Organizations using affected versions should upgrade to this version or later to mitigate the risk (Ivanti Releases).