{"schema":"threatline.record/2","record":{"id":"CVE-2023-38035","aliases":[],"summary":"Ivanti Sentry Authentication Bypass Vulnerability","details":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","categories":["Network & edge"],"product":"Sentry","vendor":"Ivanti","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-38035","source_modified_at":"2025-10-21T23:05:40.307Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"MobileIron Sentry","vendor":"Ivanti","versions":[{"version":"9.18.0 and below","status":"affected","lessThan":"9.18.0 and below","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2023-38035","source_modified_at":"2025-10-21T23:05:40.307Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"MobileIron Sentry","ecosystem":null},"version":"9.18.0 and below","basis":"first unaffected version stated in the CVE record"}],"cvss":9.8,"severity":"Critical","kev":{"listed":true,"date_added":"2023-08-22","due_date":"2023-09-12","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Known"},"epss":{"probability":0.9995,"percentile":0.99975,"score_date":"2026-10-23"},"published_at":"2023-08-21T16:51:20.678Z","modified_at":"2025-10-21T23:05:40.307Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2023-38035","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:05:40.307Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_sentry_misc_log_service.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2023-08-21"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38035.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2023-38035","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","Metasploit","Nuclei","EPSS"],"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US","source":"CISA KEV"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38035","source":"CISA KEV"},{"source":"CVE List","url":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035","tags":["government-resource"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CISA ADP","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2024-07-16T03:55:31.632449Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"Ivanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_sentry_misc_log_service.rb","date":"2023-08-21","added":"2026-04-22","check":true},{"source":"Nuclei","kind":"Scanner template","name":"Ivanti Sentry - Authentication Bypass","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38035.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:05:40.307Z","content_hash":"3fb9016153bb08a507346b1fc120227ec5ef3d6ec75f244a6d52812457baed0a"}}