Software company Ivanti has recently disclosed new security vulnerabilities in its Endpoint Manager Mobile (EMM) product. The vulnerabilities, named CVE-2023-35082 and CVE-2023-35081, allow unauthorized remote attackers to access users’ personal information and make limited changes to the server through the EMM API. The latest vulnerability (CVE-2023-35082) has a high CVSS score of 10, indicating its severity. Ivanti recommends affected users to upgrade to the latest version of EMM as the affected versions (Mobileiron 11.2 and prior) are no longer supported.
The vulnerabilities in the EMM API are attributed to permissive entries in the security filter chain of the appliance’s web application. This allows attackers to access API endpoints and perform various operations, including disclosing personally identifiable information and making modifications to the platform.
Moreover, a previously-patched vulnerability (CVE-2023-35081) with a lower CVSS score of 7.2 could be exploited in combination with CVE-2023-35082. Such an attack could enable an authenticated attacker to write malicious files to the appliance and potentially execute them.
As a precautionary measure, Ivanti encourages users to promptly upgrade their systems to protect against potential security risks arising from these vulnerabilities.
