Ivanti · Sentry
CVE-2023-38035
Ivanti Sentry Authentication Bypass Vulnerability
Cos'è
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CISA: Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Cosa fare
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 12 settembre 2023
Altre falle sfruttate di Ivanti
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 11 giu 2026 | OS Command Injection | Sentry | Critica 10,0 | 99,9% |
| 30 ott 2026 | Missing Authentication for Critical Function | Connect Secure | Alta 7,0 | 0,5% |
| 30 ott 2026 | Generation of Predictable Numbers or Identifiers | Connect Secure | 0,8% | |
| 13 ott 2026 | Authentication Bypass by Spoofing | Connect Secure | Alta 8,6 | 89% |
| 7 mag 2026 | Improper Input Validation | Endpoint Manager Mobile (EPMM) | Alta 7,2 | 34% |
| 8 apr 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critica 9,8 | 99% |
| 9 mar 2026 | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | Alta 8,6 | 88% |
| 29 gen 2026 | Code Injection | Endpoint Manager Mobile (EPMM) | Critica 9,8 | 99% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.