An issue was discovered in Ivanti Endpoint Manager before...
Moderate severity
Unreviewed
Published
Sep 21, 2023
to the GitHub Advisory Database
•
Updated Sep 25, 2024
Description
Published by the National Vulnerability Database
Sep 21, 2023
Published to the GitHub Advisory Database
Sep 21, 2023
Last updated
Sep 25, 2024
An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. A file disclosure vulnerability exists in the GetFileContents SOAP action exposed via /landesk/managementsuite/core/core.secure/OsdScript.asmx. The application does not sufficiently restrict user-supplied paths, allowing for an authenticated attacker to read arbitrary files from a remote system, including the private key used to authenticate to agents for remote access.
References