Summary:
Researchers have added a recently patched but previously exploited critical vulnerability to its Known Exploited Vulnerabilities catalog. The flaw affects Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core, marked as CVE-2023-35082 with a CVSS score of 9.8. This authentication bypass vulnerability serves as a patch bypass for another flaw (CVE-2023-35078, CVSS score: 10.0) that was actively exploited in April 2023 against Norwegian government entities. If successfully exploited, the vulnerability allows an unauthorized remote actor to potentially access users' personally identifiable information and make limited server changes. The impacted versions include Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9, and 11.8, as well as MobileIron Core 11.7 and below. The heightened risk underscores the importance of promptly applying security patches to safeguard against potential cyber threats.[/subscribe_to_unlock_form]
Summary:
Researchers have added a recently patched but previously exploited critical vulnerability to its Known Exploited Vulnerabilities catalog. The flaw affects Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core, marked as CVE-2023-35082 with a CVSS score of 9.8. This authentication bypass vulnerability serves as a patch bypass for another flaw (CVE-2023-35078, CVSS score: 10.0) that was actively exploited in April 2023 against Norwegian government entities. If successfully exploited, the vulnerability allows an unauthorized remote actor to potentially access users' personally identifiable information and make limited server changes. The impacted versions include Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9, and 11.8, as well as MobileIron Core 11.7 and below. The heightened risk underscores the importance of promptly applying security patches to safeguard against potential cyber threats.[emaillocker id="1283"]
Recommendations:
References:
The following reports contain further technical details:
https://thehackernews.com/2024/01/us-cybersecurity-agency-warns-of.html
[/emaillocker]