CVE-2023-38035

2023-08-2116:51:20

hackerone

github.com

security

vulnerability

mics admin portal

ivanti mobileiron sentry

authentication

apache httpd

AI Score

9.8

Confidence

High

EPSS

0.975

Percentile

100.0%

SSVC

Exploitation

active

Automatable

yes

Technical Impact

total

JSON

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ivanti:mobileiron_sentry:*:*:*:*:*:*:*:*"
    ],
    "vendor": "ivanti",
    "product": "mobileiron_sentry",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "9.18.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]