CVE-2023-46808

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
IvantiITSM>= 2023.3, <= 2023.3
ivantineurons_for_itsm< 2023.4

References

Timeline

Published
Mar 31, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-468097.4Node.js versions which bundle an unpatched version of OpenSSL or run against a dynamically linked version of OpenSSL which are unpatched areCVE-2023-46815.5NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468107.3A local privilege escalation vulnerability in Ivanti Secure Access Client for Linux before 22.7R1, allows a low privileged user to execute cCVE-2023-468137.0An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect acceCVE-2023-468147.8A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute cCVE-2023-468158.8An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in CVE-2023-468168.8An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been idCVE-2023-468179.8An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized befoCVE-2023-468187.2An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_alCVE-2023-468195.3Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.CVE-2023-46825.5Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-468205.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Iulia Cazan Image Regenerate & Select Crop.This issue affects Im
CVE-2023-46808: Critical severity, CVSS 9.9 | Vulnix