QID 730864

Date Published: 2023-08-03

QID 730864: Ivanti Endpoint Manager Mobile (EPMM) Remote Unauthenticated API Access Vulnerability (CVE-2023-35082)

Ivanti Endpoint Manager Mobile Ivanti EPMM is a mobile management software engine that enables IT to set policies for mobile devices applications and content. This product enables mobile device management mobile application management and mobile content management capabilities.

CVE-2023-35082: Ivanti Endpoint Manager Mobile (EPMM) is vulnerable to unauthenticated API access vulnerability.

Affected Versions:
This vulnerability impacts all versions of all versions of Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9 and 11.8 and MobileIron Core 11.7 and below.

QID Detection Logic (Unauthenticated):
This QID will send a GET request to the end-point "/mifs/asfV3/api/v2/admins/users" and flags if accessible.
This QID will also send a GET request to the end-point "mifs/user/login.jsp" to confirm if it is a Ivanti's EPMM or MobileIron and then it sends one more GET request to the end-point "mifs/c/windows/api/v2/device/registration" to read the version information. If the version is vulnerable, this QID gets posted.

Successful exploitation can result in Remote Unauthenticated API Access Vulnerability.

CVSS V3 rated as Critical - 10 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Ivanti has released temporary rpm to address the issue. Refer to Ivanti Advisory Ivanti Security Updates for additional information on obtaining the fixes.

Vendor References

Ivanti Endpoint Manager Mobile - forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US

CVEs related to QID 730864

CVE-2023-35082 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2023-35082			forums.ivanti.com/s/article/CVE-2023-35082-Remote-Unauthenticated-API-Access-Vulnerability-in-MobileIron-Core-11-2-and-older?language=en_US

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].