{"api_version":"1","generated_at":"2026-04-22T16:06:30+00:00","cve":"CVE-2023-35084","urls":{"html":"https://cve.report/CVE-2023-35084","api":"https://cve.report/api/cve/CVE-2023-35084.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-35084","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-35084"},"summary":{"title":"CVE-2023-35084","description":"Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely.","state":"PUBLIC","assigner":"support@hackerone.com","published_at":"2023-10-18 04:15:00","updated_at":"2023-10-25 00:17:00"},"problem_types":["CWE-502"],"metrics":[],"references":[{"url":"https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US","name":"https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US","refsource":"MISC","tags":[],"title":"Ivanti Community","mime":"text/html","httpstatus":"200","archivestatus":"429"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-35084","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35084","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"35084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"endpoint_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"35084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"endpoint_manager","cpe6":"2022","cpe7":"-","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"35084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"endpoint_manager","cpe6":"2022","cpe7":"su1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"35084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"endpoint_manager","cpe6":"2022","cpe7":"su2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"35084","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ivanti","cpe5":"endpoint_manager","cpe6":"2022","cpe7":"su3","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-35084","ASSIGNER":"support@hackerone.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previous versions, which could allow an attacker to execute commands remotely."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Ivanti","product":{"product_data":[{"product_name":"Endpoint Manager","version":{"version_data":[{"version_value":"not down converted","x_cve_json_5_version_data":{"versions":[{"version":"2022 su3","status":"unaffected","lessThan":"2022 su3","versionType":"custom"}],"defaultStatus":"affected"}}]}}]}}]}},"references":{"reference_data":[{"url":"https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US","refsource":"MISC","name":"https://forums.ivanti.com/s/article/SA-2023-08-08-CVE-2023-35084?language=en_US"}]}},"nvd":{"publishedDate":"2023-10-18 04:15:00","lastModifiedDate":"2023-10-25 00:17:00","problem_types":["CWE-502"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:endpoint_manager:2022:su1:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"2022","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:endpoint_manager:2022:-:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:endpoint_manager:2022:su2:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ivanti:endpoint_manager:2022:su3:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}