Ivanti EPMM API Authentication bypass (CVE-2023-35078/CVE-2023-35082) - Vulnerability Database

Ivanti EPMM API Authentication bypass (CVE-2023-35078/CVE-2023-35082)

Description

Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, is vulnerable to API Authentication bypass vulnerability. An attacker could exploit this vulnerability to access users' personally identifiable information and make changes to the server.

Remediation

Upgrade to the latest version of Ivanti EPMM

References

CVE-2023-35078 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - Remote Unauthenticated API Access Vulnerability

CVE-2023-35082 - MobileIron Core Unauthenticated API Access Vulnerability

Related Vulnerabilities

Severity

High

Classification

CVE-2023-35078

CVE-2023-35082

CWE-287

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N