Ivanti · Sentry
CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
Qué es
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CISA: Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Qué hacer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Plazo para las agencias federales de EE. UU.: 12 de septiembre de 2023
Más fallos explotados de Ivanti
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 11 jun 2026 | OS Command Injection | Sentry | Crítica 10,0 | 99,9% |
| 30 oct 2026 | Missing Authentication for Critical Function | Connect Secure | Alto 7,0 | 0,5% |
| 30 oct 2026 | Generation of Predictable Numbers or Identifiers | Connect Secure | 0,8% | |
| 13 oct 2026 | Authentication Bypass by Spoofing | Connect Secure | Alto 8,6 | 89% |
| 7 may 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | Alto 7,2 | 34% |
| 8 abr 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Crítica 9,8 | 99% |
| 9 mar 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | Alto 8,6 | 88% |
| 29 ene 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Crítica 9,8 | 99% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.