Critical vulnerability in a popular mobile device management solution from Ivanti has been exploited in the wild in limited attacks

CVE-2023-35078: Ivanti Endpoint Manager Mobile (EPMM) / MobileIron Core Unauthenticated API Access Vulnerability

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is affected by an undisclosed unauthenticated API access vulnerability.

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is < 11.8.1.1, 11.9.x < 11.9.1.1, or 11.10.x < 11.10.0.2. It is, therefore, affected by an undisclosed unauthenticated API access vulnerability.

Note that Nessus has not tested for the temporary RPM-based mitigations that Ivanti has provided for unsupported EPMM versions.

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number.

ID	Name	Product	Family	Type	Severity
179167	Ivanti Endpoint Manager Mobile Remote Unauthenticated API Access (CVE-2023-35078)	Nessus	Misc.	Remote	critical
178783	Ivanti Endpoint Manager Mobile < 11.8.1.1 / 11.9.x < 11.9.1.1 / 11.10.x < 11.10.0.2 Remote Unauthenticated API Access (CVE-2023-35078)	Nessus	Misc.	Combined	critical

Detections

Analytics

CVE-2023-35078

critical

Tenable Plugins

critical

critical