This vulnerability (CWE-73) in Ivanti Endpoint Manager allows an authenticated remote attacker to externally control the filename or path used in the core system, leading to full write access over an S3 bucket configured for session recording storage. This could enable the attacker to modify or inject data into the bucket. The vulnerability affects versions prior to 2024 SU7. The CVSS 3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high impact on integrity but no impact on confidentiality or availability. The product is cloud-hosted, and the vendor manages remediation.

An attacker with valid authentication can write arbitrary data to the S3 bucket used for session recording storage, potentially compromising the integrity of session data. There is no direct impact on confidentiality or availability according to the CVSS vector. The scope of the vulnerability is changed, indicating that the attack affects resources beyond the initially vulnerable component.

The vendor manages remediation for this cloud-hosted service. A patch is available that fixes the vulnerability in versions 2024 SU7 and later. Users should ensure their Ivanti Endpoint Manager service is updated to 2024 SU7 or later to mitigate this issue. Check the vendor advisory for confirmation and detailed remediation instructions.