nvd-json-data-feeds/CVE-2023/CVE-2023-383xx/CVE-2023-38344.json

{
  "id": "CVE-2023-38344",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2023-09-21T21:15:10.877",
  "lastModified": "2023-09-22T01:25:45.750",
  "vulnStatus": "Awaiting Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access."
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://gist.github.com/bhyahoo/76533e91840200a1d9f3fb1eb87eb0f1",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.ivanti.com/releases",
      "source": "cve@mitre.org"
    }
  ]
}