CVE-2023-39336

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the internal network to execute arbitrary SQL queries and retrieve output without the need for authentication. Under specific circumstances, this may also lead to RCE on the core server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393379.1A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier t CVE-2023-393386.8Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sen CVE-2023-393394.9A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fi CVE-2023-393407.5A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to CVE-2023-393413.3"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deni CVE-2023-393423.6Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-CVE-2023-393434.3Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which use CVE-2023-393448.8social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, wh CVE-2023-393457.5strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the u CVE-2023-393469.8LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21 CVE-2023-393479.0Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labels CVE-2023-393485.3Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL alwa