CVE-2023-38035
About
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
Rainforest analyst review
The weakness is in the MICS Admin Portal of Ivanti MobileIron Sentry (versions 9.18.0 and below), where an overly permissive Apache HTTPD configuration fails to properly restrict access to the administrative interface on port 8443. An attacker who can reach that port bypasses authentication and reaches administrative system-configuration functionality, from which they can change settings and execute commands, giving unauthenticated remote control of the appliance.
Sentry acts as a gatekeeper for mobile device traffic, brokering access to ActiveSync and backend resources, so it holds sensitive configuration and sits in a trusted position at the network edge. This was disclosed in the same period as the broader wave of Ivanti EPMM/MobileIron exploitation and was used in targeted intrusions, landing on CISA's KEV list. Ivanti's guidance was to restrict access to the management interface as the primary mitigation and apply the RPM patch. The practical priority is to ensure port 8443 is never reachable from the internet or untrusted segments, patch to a fixed version, and review the appliance for configuration changes and signs of hands-on activity given its exposed, trusted role.
References
- http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html
- https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035
Related CVEs
Frequently asked questions
What is CVE-2023-38035?
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
How severe is CVE-2023-38035?
CVE-2023-38035 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2023-38035 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
Which products are affected by CVE-2023-38035?
Public advisories list the following as affected: mobileiron sentry. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2023-38035?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.