CVE-2023-38035

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - support@hackerone.com

Published

2023-08-21

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2023-08-22, action due 2023-09-12: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-863

Affected products

• Mobileiron Sentry (Ivanti)

References

• http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
• https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035