Authentication Bypass in Ivanti Sentry (CVE‑2023‑38035) Risks Admin Interface Access

Authentication Bypass in Ivanti Sentry (CVE‑2023‑38035) Threatens Administrative Interfaces

What It Is – Ivanti Sentry (formerly MobileIron Sentry) contains an authentication‑bypass flaw. An overly permissive Apache HTTPD configuration allows an unauthenticated actor to reach the administrative console.

Exploitability – The vulnerability is publicly disclosed (CVE‑2023‑38035) and can be exploited without credentials. No public exploit code has been observed, but the attack path is trivial once the misconfiguration is present.

Affected Products – Ivanti Sentry 10.x and later (on‑premises deployments that use the bundled Apache HTTPD front‑end).

Why It Matters for Trust & Control Assurance

• Access‑control assurance – The flaw bypasses authentication, directly violating the control objective of enforcing strong, verified identity before privileged actions.
• Configuration‑management hygiene – An insecure web‑server setting signals gaps in baseline hardening and continuous configuration monitoring.
• Audit‑ready evidence – Demonstrating that admin interfaces are locked down and that changes are logged satisfies multiple frameworks (e.g., NIST CSF Identify and Protect functions) and gives buyers defensible proof of a secure posture.

Recommended Actions

• Apply Ivanti’s security patch for CVE‑2023‑38035 immediately.
• Review and tighten Apache HTTPD directives (e.g., restrict AllowOverride, enforce Require all denied for non‑trusted paths).
• Enable multi‑factor authentication on the Sentry admin console and enforce least‑privilege service accounts.
• Deploy continuous configuration monitoring to detect drift in web‑server settings.
• Capture remediation evidence (patch version, config snapshots, MFA logs) for audit trails.

Source: CISA KEV – CVE‑2023‑38035