Ivanti · Endpoint Manager Mobile (EPMM)
CVE-2023-35078
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
무엇인가
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CISA: Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.
할 일
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2023년 8월 15일
- CISA 목록에 추가됨
- 2023년 7월 25일
- 게시됨
- 2023년 7월 25일
- 심각도
- 치명적 10.0 CVSS 3.0
- 향후 30일 내 공격 가능성(EPSS)
- >99.9% 알려진 모든 취약점 중 상위 0.1%
- 약점 유형
- CWE-287
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(4)
- https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
- https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
- https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-e…
- https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
Ivanti의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 5. 7. | Improper Input Validation | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 34% |
| 2026. 4. 8. | Code Injection | Endpoint Manager Mobile (EPMM) | 치명적 9.8 | 99% |
| 2026. 1. 29. | Code Injection | Endpoint Manager Mobile (EPMM) | 치명적 9.8 | 99% |
| 2025. 5. 19. | Authentication Bypass | Endpoint Manager Mobile (EPMM) | 보통 5.3 | 99.9% |
| 2025. 5. 19. | Code Injection | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 88% |
| 2023. 7. 31. | Path Traversal | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 64% |
| 2026. 10. 30. | Missing Authentication for Critical Function | Connect Secure | 높음 7.0 | 0.5% |
| 2026. 10. 30. | Generation of Predictable Numbers or Identifiers | Connect Secure | 0.8% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.