What is CVE-2023-38035?

CVE-2023-38035 is a critical security vulnerability identified in Ivanti MobileIron Sentry versions up to and including 9.18.0. This vulnerability allows attackers to bypass authentication controls on the administrative interface, potentially leading to unauthorized access and data breaches. Users are advised to update their software to the latest version and restrict access to the MICS Admin Portal to minimize risks.

Who is impacted by this?

Users of Ivanti MobileIron Sentry software, specifically those using versions up to and including 9.18.0, are impacted by CVE-2023-38035. This issue allows attackers to bypass authentication controls on the administrative interface, potentially leading to unauthorized access and data breaches.

What should I do if I’m affected?

If you're affected by the CVE-2023-38035 vulnerability, it's crucial to take immediate action to protect your systems. Here's a simplified list of steps to follow:

1. Update Ivanti Sentry to the latest version to patch the vulnerability.

2. Restrict access to the MICS Admin Portal to internal management networks only.

3. Monitor logs for signs of unauthorized access or exploitation attempts.

4. Implement strong authentication and access control mechanisms for sensitive API endpoints.

By following these steps, you can minimize the risk of unauthorized access and data breaches associated with this vulnerability.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, CVE-2023-38035 is listed in CISA's Known Exploited Vulnerabilities Catalog. Added on August 22, 2023, with a due date of September 12, 2023, the required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-863, which refers to incorrect authorization issues in Ivanti MobileIron Sentry.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below:

• Metasploit module for Ivanti Sentry Authentication Bypass / Remote Code Execution

• CVE-2023-38035 – API Authentication Bypass on Sentry Administrator Interface

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog