by Kastro
Paper/Archive/CVE-2023-35078

CVE-2023-35078

Ivanti Endpoint Manager Mobile — Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

KEV · due 15 Augransomware useEPSS 100%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Affected

ProductAffectedFixed inSource
Endpoint Manager Mobilesee advisory11.10CNA
endpoint_manager_mobile11.10.0.1 – < 11.10.0.211.10.0.2CISA-ADP
endpoint_manager_mobile11.9.1.0 – < 11.9.1.111.9.1.1CISA-ADP
endpoint_manager_mobile11.8.1.0 – < 11.8.1.111.8.1.1CISA-ADP
endpoint_manager_mobile≤ 11.8.1.0–CISA-ADP
endpoint_manager_mobile11.10.0.1 – < 11.10.0.211.10.0.2CISA-ADP
endpoint_manager_mobile11.9.1.0 – < 11.9.1.111.9.1.1CISA-ADP
endpoint_manager_mobile11.8.1.0 – < 11.8.1.111.8.1.1CISA-ADP
endpoint_manager_mobile≤ 11.8.1.0–CISA-ADP
endpoint_manager_mobile11.10.0.1 – < 11.10.0.211.10.0.2CISA-ADP
endpoint_manager_mobile11.9.1.0 – < 11.9.1.111.9.1.1CISA-ADP
endpoint_manager_mobile11.8.1.0 – < 11.8.1.111.8.1.1CISA-ADP

Scores by source

hackerone (CNA)10.0CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerabilityrefforums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078refcisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078refivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerabilityrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35078kevcisa.gov/known-exploited-vulnerabilities-catalog