A vulnerability discovered in Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes, including creating an EPMM administrative account that can make further changes to a vulnerable system.
This vulnerability (CVE-2023-35078) affects supported EPMM versions 11.10, 11.9, and 11.8. Older, unsupported versions are also affected.
CERT Bulgaria urges users and organizations to review Ivanti's Security Advisory and Knowledge Base Article (customer login required) and apply the necessary patches.