An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, versions before 11.11.0.0 suffer from an authentication bypass vulnerability, allowing unauthorized users to access restricted functionality or resources of the application without proper authentication.

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is < 11.3. It is, therefore, affected by an undisclosed unauthenticated API access vulnerability.

Note that Nessus has not tested for these issues but has instead relied only on the service's self-reported version number.

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is affected by an undisclosed unauthenticated API access vulnerability.

ID	Name	Product	Family	Severity
114355	Ivanti Endpoint Manager Mobile < 11.11.0.0 Authentication Bypass	Web App Scanning	Component Vulnerability	critical
179336	Ivanti Endpoint Manager Mobile < 11.3 Remote Unauthenticated API Access (CVE-2023-35082)	Nessus	Misc.	critical
179335	Ivanti Endpoint Manager Mobile Remote Unauthenticated API Access (CVE-2023-35082)	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-35082

critical

Tenable Plugins

critical

critical

critical