Ivanti · Endpoint Manager Mobile (EPMM)
CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
ما هي
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CISA: Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
ما العمل
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
الموعد النهائي للوكالات الفدرالية الأمريكية: 15 أغسطس 2023
- أُضيفت إلى قائمة CISA
- 25 يوليو 2023
- نُشرت
- 25 يوليو 2023
- الخطورة
- حرجة 10.0 CVSS 3.0
- احتمال الهجمات خلال الأيام الـ30 القادمة (EPSS)
- >99.9% ضمن أعلى 0.1% من كل الثغرات المعروفة
- نوع الضعف
- CWE-287
- تفاصيل أكثر
- NVD · CVE.org · CISA
كل المراجع (4)
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-e…
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
ثغرات مُستغلّة أخرى من Ivanti
| أُضيفت | الثغرة | المنتج | الخطورة | احتمال الهجوم |
|---|---|---|---|---|
| 07/05/2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | مرتفع 7.2 | 34% |
| 08/04/2026 | Code Injection | Endpoint Manager Mobile (EPMM) | حرجة 9.8 | 99% |
| 29/01/2026 | Code Injection | Endpoint Manager Mobile (EPMM) | حرجة 9.8 | 99% |
| 19/05/2025 | Authentication Bypass | Endpoint Manager Mobile (EPMM) | متوسطة 5.3 | 99.9% |
| 19/05/2025 | Code Injection | Endpoint Manager Mobile (EPMM) | مرتفع 7.2 | 88% |
| 31/07/2023 | Path Traversal | Endpoint Manager Mobile (EPMM) | مرتفع 7.2 | 64% |
| 30/10/2026 | Missing Authentication for Critical Function | Connect Secure | مرتفع 7.0 | 0.5% |
| 30/10/2026 | Generation of Predictable Numbers or Identifiers | Connect Secure | 0.8% |
المصادر: Known Exploited Vulnerabilities (CISA، ملكية عامة)، وCVE records (cve.org)، وEPSS (FIRST). احتمال الهجوم هو تقدير EPSS لاحتمال أن يحاول أحد استغلال الثغرة خلال الأيام الـ30 القادمة.