IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
10.0Kritik KEV Fidye yazılımında kullanılıyor

CVE-2023-35078Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

Ivanti Endpoint Manager Mobile; ivanti endpoint_manager_mobile Yayım: (3 yıl önce)

Aktif olarak istismar ediliyor — Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 25.07.2023 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.08.2023.

Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35078

Açıklama

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

Zayıflık türü (CWE): CWE-287

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
Ivanti Endpoint Manager Mobile all versions

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (3)
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* < 11.8.1.1
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* ≥ 11.9.0 < 11.9.1.1
  • cpe:2.3:a:ivanti:endpoint_manager_mobile:*:*:*:*:*:*:*:* ≥ 11.10 < 11.10.0.2

Aynı üründe son açıklar — Ivanti (Connect Secure, EPMM…)

9.9Kritik
CVE-2026-109412
Ivanti Neurons Patch for Intune

An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.

7.7Yüksek
CVE-2026-106047
Ivanti Xtraction

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.

7.5Yüksek
CVE-2026-106043
Ivanti Xtraction

A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.

9.9Kritik
CVE-2026-106042
Ivanti Xtraction

An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmi…

5.5Orta
CVE-2026-106035
Ivanti Xtraction

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log.