CVE-2023-39338
- State
- Published
- Severity
- 6.8 Medium
- Published
- Jul 12, 2025
- Updated
- Feb 26, 2026
- Reserved
- Jul 28, 2023
Description
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 6.8 Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N | hackerone |
Weaknesses
- CWE-732 Incorrect Permission Assignment for Critical Resource
Affected Products
| Product | Versions |
|---|---|
SentryIvanti |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.