CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
CVSS
—
Sem CVSS
EPSS
100.0%
p100
KEV
SIM
22 de ago. de 2023
Exploit Today
80
0-100
Publicado: — · Última mod.: —
Produto
Ivanti / Sentry
Vulnerabilidade
Ivanti Sentry Authentication Bypass Vulnerability
Adicionado ao KEV
22 de ago. de 2023
Corrigir até
12 de set. de 2023
Uso conhecido em ransomware
Sim
Descrição resumida
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Ação necessária
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notas
https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-38035