CVE-2023-46808

—

CVSS 3.1

9.9 critical

EPSS

2%p80

Published

Mar 31, 2024 (Mar 31, 2024)

Modified

Jun 17, 2026

Description

An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation may lead to execution of commands in the context of non-root user.

Vendors: ivanti
Products: neurons for itsm
Weakness: CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.0%)

In the news3 stories

Ivanti Rushes Patches for 4 New Flaws in Connect Secure and Policy Secure

The Hacker NewsApr 4, 06:30 UTC · Apr 4, 2024Vulnerability CVE-2024-21894 CVE-2024-22052 CVE-2024-22053+3 CVEs

Ivanti Releases Urgent Fix for Critical Sentry RCE Vulnerability

The Hacker NewsMar 22, 03:01 UTC · Mar 22, 2024Vulnerability CVE-2023-41724 CVE-2023-46808 CVE-2023-47479

Ivanti fixes RCE vulnerability reported by NATO cybersecurity researchers (CVE-2023-41724)

Help Net SecurityMar 20, 00:00 UTC · Mar 20, 2024Vulnerability in the wildCVE-2023-41724 CVE-2023-46808