XSS stocké dans Ivanti Endpoint Manager antérieur à la version 2024 SU4 SR1 permet à un attaquant non authentifié distant d'exécuter du JavaScript arbitraire dans le contexte d'une session administrateur. Interaction utilisateur

The impact of CVE-2025-10573 is significant due to the potential for complete account takeover. An attacker can leverage this XSS vulnerability to execute malicious scripts within the administrator's session, granting them full control over the Ivanti Endpoint Manager system. This could lead to unauthorized access to sensitive data, modification of system configurations, deployment of malware to managed endpoints, and potentially, lateral movement within the network. The requirement for user interaction is a factor, but social engineering techniques could be employed to trick administrators into triggering the vulnerability.

Organizations heavily reliant on Ivanti Endpoint Manager for endpoint management and security are at significant risk. Specifically, environments with limited security awareness training among administrators, or those using older, unpatched versions of the software, are particularly vulnerable. Shared hosting environments where multiple users share the same Ivanti Endpoint Manager instance also face increased risk.

• windows / supply-chain: Monitor Ivanti Endpoint Manager logs for unusual JavaScript execution patterns. Use Windows Defender to scan for suspicious scripts.

Get-WinEvent -LogName Application -Filter "EventID=1001 and Source='Ivanti Endpoint Manager'" | Where-Object {$_.Message -match 'javascript:'}

• linux / server: Monitor web server access logs for requests containing suspicious JavaScript code. • wordpress / composer / npm: N/A - This vulnerability is not related to WordPress, Composer, or npm. • database (mysql, redis, mongodb, postgresql): N/A - This vulnerability is not related to databases. • generic web: Use curl to test endpoints for XSS vulnerabilities. Inspect response headers for unusual content.

echo '<script>alert("XSS")</script>' | curl -X POST -d @- https://your-ivanti-endpoint-manager/some-endpoint

1. 2025-12-09Disclosure

   disclosure

1. Réservé2025-09-16
2. Publiée2025-12-09
3. Modifiée2026-02-26
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-10573 is to upgrade Ivanti Endpoint Manager to a version that includes the security patch. Ivanti has not yet released a fixed version as of the publication date. Until a patch is available, consider implementing temporary workarounds such as strict input validation on all user-supplied data, particularly in areas where administrator privileges are required. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense. Regularly review and audit administrator access controls to minimize the potential impact of a successful attack.