CVE-2023-35082

🗓️ 15 Aug 2023 15:11:56Reported by hackeroneType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 2811 Views🌐 WEB

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication

Reporter	Title	Published	Views	Family All 25
GithubExploit	Exploit for Improper Authentication in Ivanti Endpoint_Manager_Mobile	4 Aug 202316:25	–	githubexploit
ATTACKERKB	CVE-2023-35082	15 Aug 202300:00	–	attackerkb
BDU FSTEC	The vulnerability of the endpoint management application for mobile devices and mobile applications, Ivanti Endpoint Manager Mobile (EPMM) (formerly MobileIron Core), is related to authentication procedures that allow attackers to bypass the authentication process.	29 Jul 202400:00	–	bdu_fstec
Circl	CVE-2023-35082	3 Aug 202305:38	–	circl
CISA KEV Catalog	Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability	18 Jan 202400:00	–	cisa_kev
CISA	CISA Adds One Known Exploited Vulnerability to Catalog	18 Jan 202412:00	–	cisa
CNNVD	Ivanti EPMM Authorization Issues Vulnerability	15 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-35082	15 Aug 202315:11	–	cvelist
Ivanti	CVE-2023-35082 – Remote Unauthenticated API Access Vulnerability	2 Aug 202315:56	–	ivanti
Tenable Nessus	Ivanti Endpoint Manager Mobile < 11.3 Remote Unauthenticated API Access (CVE-2023-35082)	3 Aug 202300:00	–	nessus

NVD

Vulners

Node

ivanti endpoint_manager_mobileRange<11.11.0

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Ivanti",
    "product": "EPMM",
    "versions": [
      {
        "version": "11.10",
        "status": "affected",
        "lessThanOrEqual": "11.10",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
forums	www.forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
adminDeviceSpaceId	path	/mifs/asfV3/api/v2/authorized/users	Unauthenticated access to /mifs/asfV3/api/v2/authorized/users may reveal user data via exposed API endpoint.	CWE-287
adminDeviceSpaceId	path	/mifs/aad/api/v2/authorized/users	Unauthenticated access to /mifs/aad/api/v2/authorized/users may reveal user data via exposed API endpoint.	CWE-287

17 Jun 2026 06:04Current

9.5Critical risk

Vulners AI Score9.5

CVSS 3.19.8

CVSS 310

EPSS0.99999

SSVC