CVE-2023-39338 - Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service · CoreCVE

Back Back to CVE browser

MEDIUM

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service

Published Jul 12, 2025

6.8

MEDIUM

CVSS 3.0

EPSS 0.96%

Description

Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.

Affected products

Vendor Ivanti Product Sentry Default
unaffected
- Version
  9.0
  Status
  affected
  Constraints
  <9.20

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
9.0	affected	<9.20

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (1)

https://forums.ivanti.com/s/article/CVE-2023-39338

Link	Providers	Tags
https://forums.ivanti.com/s/article/CVE-2023-39338

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Jul 12, 2025

Updated Feb 26, 2026

Reserved Jul 28, 2023

Link CVE-2023-39338

CISA Vulnrichment

Updated Jul 15, 2025

Status Deferred

Modified Jun 17, 2026

Link CVE-2023-39338

Severity n/a

Public date n/a

Links CVE-2023-39338