Threat Brief: Multiple Vulnerabilities Including Zero-Day Remote Unauthenticated API Access – CVE-2023-35078 – in Ivanti Endpoint Manager Mobile (Updated)
Summary: Ivanti Endpoint Manager Mobile (formerly MobileIron Core) disclosed an unauthenticated API access zero-day, CVE-2023-35078, on July 24, 2023, affecting versions 11.10, 11.9 and 11.8, with older versions also at risk; it carries a CVSS v3.0 base score of 10.0. Cortex Xpanse found over 5,500 Ivanti EPMM servers exposed on the internet across 85 countries, with Germany and the United States each hosting over 1,000, and the only publicly confirmed victims so far are Norwegian government ministries.
What's compelling: Exploitation needs no proof-of-concept code - the API is exposed by default, so an unauthenticated actor can pull PII and create accounts or change configuration with documented commands, and Unit 42 notes that just under a quarter of the servers it could fingerprint were on supported versions.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-32560CVE-2023-35078CVE-2023-35081CVE-2023-35082CVE-2023-38035
- Related
- CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) and Mobile Iron Core Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Jan 18, 2024CVE-2023-38035: Ivanti Sentry Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 22, 2023CVE-2023-35081: Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability Known Exploited Vulnerabilities · Jul 31, 2023