CVE-2023-38035criticalunder attackransomwareCWE-863

CVE-2023-38035: critical vulnerability in Ivanti MobileIron Sentry

Published · Updated

Follow this CVE+ Monitor Sentry+ Monitor MobileIron Sentry

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon2 days
Published on NVDAug 21
1st PoC+2d
metasploitAug 21
CISA KEV+1d
Action required by CISAfederal deadline: 2023-09-12

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

The MICS Admin Portal in Ivanti MobileIron Sentry has a flaw in its web server setup that allows attackers to skip login checks and access the administrative interface without proper credentials.

Technical detail

An insufficiently restrictive Apache HTTPD configuration in Ivanti MobileIron Sentry 9.18.0 and below enables authentication bypass on the MICS Admin Portal administrative interface. The vulnerability stems from improper access control enforcement (CWE-863), allowing unauthenticated attackers to directly access privileged functions with critical impact on confidentiality, integrity, and availability.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · MobileIron Sentry
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.