CVE-2023-35078

🗓️ 25 Jul 2023 06:08:38Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 3040 Views

Ivanti Endpoint Manager Mobile (EPMM) through 11.10 allows remote attackers to obtain PII and add an administrative account

Reporter	Title	Published	Views	Family All 55
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	29 Jul 202319:58	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	31 Jul 202318:21	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	4 Aug 202316:25	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	21 Aug 202505:53	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	29 Jul 202305:06	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	31 Jul 202302:24	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	31 Jul 202302:24	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	1 Aug 202315:41	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	31 Jul 202302:24	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	30 Aug 202302:36	–	githubexploit

NVD

Vulnrichment

Node

ivanti endpoint_manager_mobileRange<11.8.1.1

ivanti endpoint_manager_mobileRange11.9.0–11.9.1.1

ivanti endpoint_manager_mobileRange11.10–11.10.0.2

[
  {
    "defaultStatus": "affected",
    "vendor": "Ivanti",
    "product": "Endpoint Manager Mobile",
    "versions": [
      {
        "version": "11.10",
        "status": "unaffected",
        "lessThanOrEqual": "11.10",
        "versionType": "semver"
      },
      {
        "version": "11.9",
        "status": "unaffected",
        "lessThanOrEqual": "11.9",
        "versionType": "semver"
      },
      {
        "version": "11.8",
        "status": "unaffected",
        "lessThanOrEqual": "11.8",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
forums	www.forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078
forums	www.forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability
ivanti	www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability
cisa	www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog