# CVE-2023-38035

A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

- Page: https://www.vulneraibility.com/cve/CVE-2023-38035
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-08-22; CISA due date 2023-09-12; known ransomware use
- EPSS: 99.95% (percentile 100.0)
- Public exploit code: 1 Metasploit module · 3 GitHub proofs of concept · 1 Nuclei template (first 2023-08-23)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-07-16)
- Weakness: CWE-863
- Published: 2023-08-21

## Affected versions

- Ivanti MobileIron Sentry: affected < 9.18.0 and below

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- [other] http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.