{"id":"CVE-2023-38035","kind":"vulnerability","aliases":["CVE-2023-38035"],"related":[],"title":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow…","description":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Ivanti Sentry has an authentication bypass in its administrative interface, caused by an overly permissive Apache HTTPD configuration. An attacker can reach admin functions without valid credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-08-22T00:00:00+00:00","products":[{"name":"Ivanti Sentry","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti mobileiron sentry","fixed":[],"affected":"<= 9.18.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ivanti-sentry","mobileiron-sentry","ransomware","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations from Ivanti's advisory; CISA says to discontinue use of the product if mitigations are unavailable.","status":"open","published_at":"2023-08-21T17:15:47+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T21:04:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:04:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from Ivanti's advisory; CISA says to discontinue use of the product if mitigations are unavailable.","reach":"network","impact":"high","summary":"Ivanti Sentry has an authentication bypass in its administrative interface, caused by an overly permissive Apache HTTPD configuration. An attacker can reach admin functions without valid credentials.","category":"vendor","who_cares":["ivanti-sentry","self-hosted","mobileiron-sentry"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker gains administrative access to Sentry without credentials.","analyst_note":"Find Ivanti's advisory for CVE-2023-38035 to confirm affected and fixed versions, the exact mitigation steps, and a check for exposure; sources give none of these.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2854,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2023':20A,23A '-38035':21A,24A '9.18.0':13A 'action':104C 'admin':6A,64B 'administr':50B,92C 'allow':18A,83C 'apach':57B,99C 'appli':105C 'attack':61B,85C 'authent':46B,78C,88C 'bypass':47B,79C,87C 'caus':52B 'cisa':102C 'configur':59B,101C 'contain':76C 'control':89C 'credenti':68B 'cve':19A,22A 'discontinu':111C 'due':94C 'exploit':30B 'former':71C 'function':65B 'host':40B 'httpd':58B,100C 'instruct':109C 'insuffici':97C 'interfac':51B,93C 'ivanti':9A,25A,27A,32B,42B,69C 'ivanti-sentri':31B 'known':72C 'may':17A,82C 'mic':5A 'mitig':106C,117C 'mobileiron':10A,28A,35B,74C 'mobileiron-sentri':34B 'over':55B 'per':107C 'permiss':56B 'portal':7A 'product':115C 'ransomwar':37B 'reach':63B 'requir':103C 'restrict':98C 'secur':2A 'self':39B 'self-host':38B 'sentri':11A,33B,36B,43B,70C,75C 'sentry':26A,29A 'unavail':119C 'use':112C 'valid':67B 'vendor':41B,108C 'version':12A 'vulner':3A,80C 'without':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-08-21T17:15:47+00:00","kev":{"dateAdded":"2023-08-22","dueDate":"2023-09-12","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2023-38035","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-38035","severity":null,"published_at":"2023-08-22T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:34+00:00","note":null},{"source":"nvd","external_id":"CVE-2023-38035","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38035","severity":null,"published_at":"2023-08-21T17:15:47+00:00","modified_at":"2026-06-17T06:09:16+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}