CVE-2023-35078 : An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Published 2023-07-25 07:15:11

Updated 2024-08-14 19:49:56

Source HackerOne

View at NVD, CVE.org

Products affected by CVE-2023-35078

Ivanti » Endpoint Manager Mobile
Versions up to, including, (<=) 11.10
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*
Matching versions

CVE-2023-35078 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.

CISA vulnerability name:

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

CISA required action:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description:

Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone num

Notes:

https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35078

Added on 2023-07-25 Action due date 2023-08-15

Exploit prediction scoring system (EPSS) score for CVE-2023-35078

EPSS FAQ

96.94%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 100 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-35078

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	HackerOne
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
10.0	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	HackerOne
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-35078

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
- support@hackerone.com (Secondary)

References for CVE-2023-35078

https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078

Exploit;Patch;Vendor Advisory
https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078

Ivanti Releases Security Updates for Endpoint Manager Mobile (EPMM) CVE-2023-35078 | CISA
Third Party Advisory;US Government Resource
https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability

CVE-2023-35078 - New Ivanti EPMM Vulnerability
Vendor Advisory
https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability

CVE-2023-35078 - Remote Unauthenticated API Access Vulnerability
Vendor Advisory