{"schemaVersion":3,"id":"CVE-2023-38035","aliases":[],"status":"published","duplicateOf":null,"title":"Ivanti Sentry Authentication Bypass Vulnerability","description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","dates":{"published":"2023-08-21T16:51:20.678Z","modified":"2025-10-21T23:05:40.307Z","reserved":null,"kevAdded":["2023-08-22T00:00:00.000Z"],"kevDue":["2023-09-12T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.9995,"percentile":0.99974,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.9995},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.9995,"percentile":0.99974}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.9995,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.9995,"percentile":0.99974}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-08-22T00:00:00.000Z","dueDate":"2023-09-12T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Ivanti Sentry Authentication Bypass Vulnerability","description":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","notes":[{"type":"url","href":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US","label":"forums.ivanti.com/s/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-38035","label":"nvd.nist.gov/vuln/detail/CVE-2023-38035"}],"vendor":"Ivanti","product":"Sentry","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2023-08-22T00:00:00.000Z","dueDate":"2023-09-12T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Ivanti Sentry Authentication Bypass Vulnerability","description":"Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","notes":[{"type":"url","href":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US","label":"forums.ivanti.com/s/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2023-38035","label":"nvd.nist.gov/vuln/detail/CVE-2023-38035"}],"vendor":"Ivanti","product":"Sentry","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"REF_F8CE147B47815A14","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_EXPLOIT_LINUX_HTTP_IVANTI_SENTRY_MISC_LOG_SERVICE","name":"Ivanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/linux/http/ivanti_sentry_misc_log_service.rb","maturity":"weaponized","reliabilityScore":1,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/linux/http/ivanti_sentry_misc_log_service","rank":"600","rankName":"excellent","postAuth":false,"check":true,"stability":["crash-safe"],"sideEffects":["ioc-in-logs","artifacts-on-disk"],"reliability":["repeatable-session"]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-863","name":"Incorrect Authorization","description":"The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/863.html"}],"affected":[{"vendor":"ivanti","product":"mobileiron_sentry","name":"mobileiron sentry","label":"mobileiron_sentry","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 9.18.0 and below, < 9.18.0 and below","noFixRecorded":false,"fixedIn":null},{"text":"≤ 9.18.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 9.18.0 and below, < 9.18.0 and below | ≤ 9.18.0","eol":null,"hubHref":"/vendor/ivanti/mobileiron_sentry"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface","label":"forums.ivanti.com/s/…","hostname":"forums.ivanti.com","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html","label":"packetstormsecurity.com/files/174643/Ivanti-Sentry-Authentication-Bypass-Remote-Code-Execution.html","hostname":"packetstormsecurity.com","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38035","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2023-08-21T16:51:20.678Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2023-08-22T00:00:00.000Z","label":"Added to CISA KEV","detail":"Ivanti Sentry Authentication Bypass Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2023-09-12T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:05:40.307Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T07:53:15.438Z","stale":false,"partial":false}}