Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-07-25
• Known to be used in ransomware campaigns
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

CISA: Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Aug 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerabilityVendor Advisory
• forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023…ExploitVendor Advisory
• www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-ma…Third Party AdvisoryUS Government Resource
• www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerabilityVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource