CISA Known Exploited Vulnerability
This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.
Remediation Deadline: Sep 12, 2023
Description
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
EPSS — Exploit Probability
94.4%
Higher than 100.0% of all CVEs
Required Action
https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-38035
Risk Assessment
CRITICALIn CISA KEV
High EPSS
Ransomware
Details
- Severity
- High
- EPSS
- 94.4%
- CISA KEV
- Yes
- Ransomware
- Known
- Articles
- 0
Timeline
Published
Aug 22, 2023
Added to KEV
Aug 22, 2023
Remediation Due
Sep 12, 2023