Description

Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, is vulnerable to API Authentication bypass vulnerability. An attacker could exploit this vulnerability to access users' personally identifiable information and make changes to the server.

Remediation

Upgrade to the latest version of Ivanti EPMM

References

CVE-2023-35078 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability

Related Vulnerabilities

WordPress Plugin Add Product Tabs for WooCommerce Security Bypass (1.4.2)

MySQL CVE-2020-14785 Vulnerability (CVE-2020-14785)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-2058)

Oracle JRE CVE-2012-4681 Vulnerability (CVE-2012-4681)

Joomla Missing Authorization Vulnerability (CVE-2021-23123)

Severity

High

Classification

CVE-2023-35078 CVE-2023-35082 CWE-287 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Tags

Authentication Bypass Known Vulnerabilities