Ivanti EPMM (MobileIron Core) Unauthenticated API Access
- Product
- Ivanti Endpoint Manager Mobile (MobileIron Core)
- CVE
- CVE-2023-35078
- Disclosed
- 2023-07-24
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Ivanti EPMM all supported versions up to 11.10, and older unsupported releases.
- Fixed
- 11.10.0.2, 11.9.1.1, 11.8.1.1 (RPM patches).
Summary
An authentication bypass in Ivanti EPMM exposed restricted API endpoints to unauthenticated users, letting them read personal data and make admin changes. It was exploited as a zero-day against Norwegian government ministries, chained with CVE-2023-35081 for code execution.
Root cause
A set of API routes under the MobileIron admin API was reachable without authentication due to incorrect access-control mapping. Attackers could query users and devices and create administrative accounts, then use a separate file-write flaw to plant a webshell.
Impact
Full control of the MDM platform and the mobile devices it manages, plus PII disclosure.
Detection
Look for unauthenticated requests to /mifs/aad/api/v2/ in access logs and unexpected admin accounts. Nuclei template CVE-2023-35078.
Mitigation
Apply the RPM patch and review admin accounts and logs.