CVE-2023-38035 - Ivanti Sentry Authentication Bypass Vulnerability
Project:Ivanti
Product:Sentry
Date Added:2023-08-22Due Date:2023-09-12
Vulnerability Name
Ivanti Sentry Authentication Bypass Vulnerability
Description
Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Known To Be Used in Ransomware Campaigns?
Known
Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Additional Notes
https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US
https://nvd.nist.gov/vuln/detail/CVE-2023-38035
Related News Articles
New HardBit Ransomware 4.0 Uses Passphrase Protection to Evade DetectionJuly 15, 2024