Critical severity · published Aug 21, 2023
CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
RansomwareIn wildKEV
9.8
CVSS
100%
EPSS
Yes
On KEV
Description
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 22, 2023
Federal remediation dueSep 12, 2023
Ransomware campaign useKnown
Affected products
Which versions
MS
MobileIron Sentry · Ivanti
9.18.0 and below before 9.18.0 and below · source: vendor, NVD, CISA
SE
Sentry · Ivanti
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38035
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
forums.ivanti.com
https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
packetstormsecurity.com
http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html