Critical · published July 25, 2023
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 An authentication bypass in Ivanti EPMM lets unauthorized users stroll right into restricted areas like it’s an open house! 🔥 This is like a hotel with a faulty check-in system that lets anyone wander into the VIP lounge without a keycard. Just because they look the part doesn’t mean they should be there! The consequences are absolutely devastating—attackers could gain unauthorized access to sensitive functionalities, potentially leading to data breaches or severe application tampering. It's a ripe opportunity for malicious activities that could compromise your entire system!
This is like a hotel with a faulty check-in system that lets anyone wander into the VIP lounge without a keycard. Just because they look the part doesn’t mean they should be there! This vulnerability allows attackers to bypass authentication checks, granting access to restricted functionalities without the need for valid credentials.
The consequences are absolutely devastating—attackers could gain unauthorized access to sensitive functionalities, potentially leading to data breaches or severe application tampering. It's a ripe opportunity for malicious activities that could compromise your entire system! Immediately patch to the latest version of Ivanti EPMM to close this gap. Review your access controls and ensure robust authentication measures are in place to safeguard sensitive areas. You've got this! By following these steps, you can bolster your defenses and protect your system. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ivanti/endpoint_manager_mobile | < 11.8.1.1 | 11.8.1.1 |
| ivanti/endpoint_manager_mobile | ≥ 11.9.0, < 11.9.1.1 | 11.9.1.1 |
| ivanti/endpoint_manager_mobile | ≥ 11.10, < 11.10.0.2 | 11.10.0.2 |