CVE-2023-35081
Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability
Description
CVE-2023-35081 is a path traversal vulnerability affecting Ivanti Endpoint Manager Mobile (EPMM) versions 11.10.x before 11.10.0.3, 11.9.x before 11.9.1.2, and 11.8.x before 11.8.1.2. The flaw allows an authenticated administrator to write arbitrary files onto the appliance by exploiting improper limitation of a pathname, potentially leading to full system compromise including code execution, data exfiltration, and denial of service. CISA has added CVE-2023-35081 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 91.1% (99th percentile), this Ivanti EPMM vulnerability represents a significant risk that demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | >= 11.8.0, < 11.8.1.2; >= 11.9.0, < 11.9.1.2; >= 11.10.0, < 11.10.0.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
In the context of CVE-2023-35081, the path traversal weakness in Ivanti EPMM allows an authenticated administrator to escape the intended directory structure and write files to arbitrary locations on the appliance. This type of vulnerability occurs when the application fails to properly sanitize user-supplied input used in file path construction, enabling directory traversal sequences (such as "../") to access restricted filesystem locations.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2023-35081 carries a CVSS 3.1 base score of 7.2 (High severity), reflecting the serious impact an attacker can achieve through this path traversal vulnerability in Ivanti EPMM. Attack Vector (Network): The vulnerability is remotely exploitable without requiring physical access to the target appliance. Attack Complexity (Low): Exploitation is straightforward with no special conditions or race conditions needed. Privileges Required (High): An attacker needs authenticated administrator-level access, which limits the initial attack surface but is significant when combined with authentication bypass vulnerabilities such as CVE-2023-35078. User Interaction (None): No action from a legitimate user is required to trigger the exploit. Impact (Confidentiality, Integrity, Availability — all High): Successful exploitation allows arbitrary file writes, which can lead to reading sensitive configuration files, modifying system binaries or configuration for persistent access, and disrupting the availability of the EPMM service. The EPSS score of 91.1% places this vulnerability in the 99th percentile, indicating a very high probability of active exploitation.
Exploit Maturity
CVE-2023-35081 is confirmed as actively exploited in the wild by CISA, which added this Ivanti EPMM path traversal vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 21, 2023. The EPSS score of 91.1% (99th percentile) indicates near-certain exploitation activity across the threat landscape. Chaining potential: CVE-2023-35081 is commonly chained with CVE-2023-35078, an authentication bypass vulnerability in the same Ivanti EPMM product — when combined, the attack chain allows an unauthenticated remote attacker to write arbitrary files to the system, significantly escalating the severity beyond what either vulnerability poses individually. While the ransomware association is currently listed as unknown, the combination of confirmed active exploitation, high EPSS score, and chaining potential makes this a critical priority for immediate action.
Remediation
- Apply vendor patches immediately — Upgrade Ivanti Endpoint Manager Mobile (EPMM) to the fixed versions: 11.10.0.3 or later for the 11.10.x branch, 11.9.1.2 or later for the 11.9.x branch, and 11.8.1.2 or later for the 11.8.x branch. If patches cannot be applied, discontinue use of the product as directed by CISA's KEV required action.
- Address the authentication bypass chain — Ensure CVE-2023-35078 is also patched, as these two vulnerabilities are commonly exploited together. An unpatched authentication bypass renders the administrator privilege requirement for CVE-2023-35081 irrelevant.
- Implement network-level restrictions — Restrict access to the EPMM administrative interface to trusted management networks only. Apply firewall rules and network segmentation to prevent direct internet exposure of the EPMM appliance.
- Review system integrity and logs — Inspect the EPMM appliance filesystem for unexpected or recently modified files, particularly in system directories. Review access logs for unauthorized administrative sessions and any indicators of compromise (IOCs) associated with these Ivanti EPMM exploits.
- Implement input validation hardening — As a long-term measure, ensure that file path inputs are validated against an allowlist of permitted directories and that directory traversal sequences are stripped or rejected at the application level. Deploy file integrity monitoring (FIM) to detect unauthorized filesystem changes.
Technical Details
CVE-2023-35081 exploits a path traversal weakness (CWE-22) in the Ivanti Endpoint Manager Mobile (EPMM) appliance, where file write operations fail to properly validate and sanitize user-supplied path components. Vulnerability mechanism: The application accepts file path input from authenticated administrator sessions without adequately restricting the target directory, allowing an attacker to inject directory traversal sequences (e.g., "../") to write files outside the intended directory. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) shows that while high privileges are required, the network-accessible attack vector with low complexity makes exploitation straightforward once administrator credentials are obtained. Exploitation in practice: The high-privilege requirement is effectively mitigated by chaining with CVE-2023-35078 (authentication bypass), converting the attack from one requiring valid admin credentials to a fully unauthenticated remote attack. The arbitrary file write capability enables an attacker to overwrite configuration files, plant web shells for persistent access, or modify system binaries to achieve remote code execution on the underlying operating system of the EPMM appliance.
Frequently Asked Questions
Is CVE-2023-35081 being actively exploited?
Yes, CVE-2023-35081 is confirmed as actively exploited. CISA added this Ivanti EPMM path traversal vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 21, 2023. The EPSS score of 91.1% (99th percentile) further confirms widespread exploitation activity.
What products are affected by CVE-2023-35081?
CVE-2023-35081 affects Ivanti Endpoint Manager Mobile (EPMM) in versions 11.10.x before 11.10.0.3, 11.9.x before 11.9.1.2, and 11.8.x before 11.8.1.2. Organizations running any of these versions should apply patches immediately.
How do I fix CVE-2023-35081?
Upgrade Ivanti EPMM to the patched versions: 11.10.0.3, 11.9.1.2, or 11.8.1.2 depending on your branch. Also ensure CVE-2023-35078 is patched, as these vulnerabilities are commonly chained. If patching is not possible, discontinue use of the product and restrict network access to the administrative interface.
How severe is CVE-2023-35081?
CVE-2023-35081 has a CVSS 3.1 base score of 7.2 (High severity) with high impact on confidentiality, integrity, and availability. The EPSS score of 91.1% places it in the 99th percentile for exploitation probability. When chained with CVE-2023-35078 (authentication bypass), the effective severity is significantly higher than the individual score suggests.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.