{"basis":"claimed","id":"CVE-2023-38035","name":"Ivanti Sentry Authentication Bypass Vulnerability","vendorProject":"Ivanti","product":"Sentry","publishedAt":"2023-08-21","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":{"kevAdded":"2023-08-22","dueDate":"2023-09-12","ransomware":true},"epss":{"score":0.9995,"percentile":0.99974,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"no_history","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"no_history","firstOn":null,"daysToRule":null},"fastly":{"status":"no_history","firstOn":null,"daysToRule":null},"f5":{"status":"rule","firstOn":"2024-03-12","daysToRule":204},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.","cwes":["CWE-863"],"vendors":[{"vendor":"cloudflare","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"no_history","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"rule","basis":"claimed","firstOn":"2024-03-12","firstIsNew":true,"daysToRule":204,"daysAtMost":null,"freePlan":false,"claims":[{"id":"d906239cea63d75c547c521761da39a73f2d5affdc9e44659b3c45fde2ca7101","cve_id":"CVE-2023-38035","vendor":"f5","product":"Attack signatures","rule_id":"200103396","rule_name":"Ivanti Sentry Remote Code Execution","change":"new","default_action":null,"published_on":"2024-03-12","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200103396 \"Ivanti Sentry Remote Code Execution\" (Command Execution, risk High), systems: Other Web Server. References: CVE-2023-38035.","first_seen_at":"2026-11-02T21:00:27.959Z"},{"id":"769dcb7761c5fc91439198ab6abf6fb8a9525f2a4739fc6ec1509832dbf0983c","cve_id":"CVE-2023-38035","vendor":"f5","product":"Attack signatures","rule_id":"200103396","rule_name":"Ivanti Sentry Remote Code Execution","change":"new","default_action":null,"published_on":"2024-05-21","source_url":"https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog","source_title":"F5 Distributed Cloud attack signatures changelog","excerpt":"Added: signature 200103396 \"Ivanti Sentry Remote Code Execution\" (Command Execution, risk High), systems: Other Web Server. References: CVE-2023-38035.","first_seen_at":"2026-11-02T21:00:27.590Z"}]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T23:17:43.687Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total"},"measured":[{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 1, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:02:57.000Z","verdict":"blocked","templateId":"CVE-2023-38035","templatePath":"http/cves/2023/CVE-2023-38035.yaml","requests":1,"blockedRequests":1,"rules":["200002"],"note":"","requestDetail":[{"method":"POST","path":"/mics/services/MICSLogService","status":400,"blocked":true,"rules":["200002"]}]},{"engineId":"owasp-crs","engineName":"OWASP Core Rule Set","engineVersion":"4.25.0","runtime":"Coraza v3.8.1","config":"paranoia level 2, anomaly threshold 5, default CRS settings","ranAt":"2026-11-02T13:03:28.000Z","verdict":"blocked","templateId":"CVE-2023-38035","templatePath":"http/cves/2023/CVE-2023-38035.yaml","requests":1,"blockedRequests":1,"rules":["200002"],"note":"","requestDetail":[{"method":"POST","path":"/mics/services/MICSLogService","status":400,"blocked":true,"rules":["200002"]}]}],"social":{"total":0,"first_seen":null,"daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":0}],"top_posts":[],"exploit_repositories":[]}}