CVE-2023-35082
Ivanti EPMM
At a glance
- Source
- NVD
- EPSS
- EPSS 100.00 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hackerone
- NVD status
- Analyzed
Description
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
Weaknesses (CWE)
- CWE-287 — Improper Authentication
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | hackerone |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 3.0 | CRITICAL 10.0 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H | NVD · support@hackerone.com (Secondary) |
European references
- ENISA EUVD · EUVD-2023-39117
- GCVE · GCVE-0-2023-35082
CERT-FR advisories
- CERTFR-2023-AVI-0615 — Vulnérabilité dans Ivanti MobileIron Core et Endpoint Manager Mobile · cert.ssi.gouv.fr
- CERTFR-2023-ALE-009 — [Mà J] Multiples vulnérabilités dans Ivanti Endpoint Manager Mobile · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:*< 11.11.0
Affected products
| Product | Versions |
|---|---|
| Ivanti · EPMM | affected 11.10 ≤ 11.10 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |