Description

Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, is vulnerable to API Authentication bypass vulnerability. An attacker could exploit this vulnerability to access users' personally identifiable information and make changes to the server.

Remediation

Upgrade to the latest version of Ivanti EPMM

References

CVE-2023-35078 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability

Related Vulnerabilities

Oracle Application Server CVE-2006-5364 Vulnerability (CVE-2006-5364)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-5834)

PHP Other Vulnerability (CVE-2015-6838)

Squid NULL Pointer Dereference Vulnerability (CVE-2023-46728)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-15132)

Severity

High

Classification

CVE-2023-35078 CVE-2023-35082 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Tags

Authentication Bypass Known Vulnerabilities