Security News > 2023 > July > Ivanti patches MobileIron zero-day bug exploited in attacks
Ivanti released security patches for the remote unauthenticated API access vulnerability tracked as CVE-2023-35078 on Sunday.
While Ivanti has published a security advisory to provide details on the security vulnerability, the information is being blocked by a login, given that the article can only be accessed with an account linked to Ivanti customer information.
"The article remains active behind log-in credentials for our customers," an Ivanti spokesperson told BleepingComputer when we asked for more details on the security flaw and for confirmation that it's already being abused in attacks.
While the company has not publicly admitted that the zero-day was actively exploited, the private bulletin says that a "Trusted source" informed Ivanti that CVE-2023-35078 was exploited in attacks against a limited number of customers.
Ivanti added that the bug is not being exploited as part of a supply chain attack, saying that it didn't find "Any indication that this vulnerability was introduced into our code development process maliciously."
"Ivanti became aware and addressed a vulnerability that impacts Ivanti Endpoint Manager Mobile customers," an Ivanti spokesperson BleepingComputer, after a second inquiry asking to confirm exploitation in attacks and if the company will release a public advisory.
News URL
Related news
- Google fixes two Android zero-days used in targeted attacks (source)
- Microsoft patches Windows zero-day exploited in attacks on Ukraine (source)
- Palo Alto Networks warns of critical RCE zero-day exploited in attacks (source)
- Palo Alto Networks patches two firewall zero-days used in attacks (source)
- Apple fixes two zero-days used in attacks on Intel-based Macs (source)
- Apple Patches Two Zero-Day Attack Vectors (source)
- Japan warns of IO-Data zero-day router flaws exploited in attacks (source)
- Fully patched Cleo products under renewed 'zero-day-ish' mass attack (source)
- New Cleo zero-day RCE flaw exploited in data theft attacks (source)
- Cleo patches critical zero-day exploited in data theft attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-07-25 | CVE-2023-35078 | Improper Authentication vulnerability in Ivanti Endpoint Manager Mobile An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. | 9.8 |