Ivanti Endpoint Manager Mobile 漏洞列表

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. FOFA: mifs

漏洞都是由于Ivanti Endpoint Manager Mobile的API组件未能正确验证输入的数据而造成的漏洞。攻击者可以利用这个漏洞绕过身份认证，并通过受影响的API执行任何代码，对系统安全造成严重损害

Ivanti Endpoint Manager Mobile (EPMM), formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available.

An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.

在Ivanti Endpoint Manager Mobile 12.5.0.0及之前版本的API组件中发现了一个远程代码执行漏洞。该漏洞允许经过身份验证的攻击者通过发送精心构造的API请求，利用Java反射机制执行任意代码，可能导致服务器被完全控制。