CVE-2023-39338
Published: 12 July 2025
Summary
CVE-2023-39338 is a medium-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Ivanti (inferred from references). Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-39338 is an improper access control vulnerability (CWE-732) affecting Ivanti Sentry. It allows an authenticated user on an enrolled device to reach a service protected by Sentry even when Sentry policy denies authorization for that service. The flaw provides only tunnel access and does not grant the ability to authenticate to or operate the service itself. The issue carries a CVSS 3.0 score of 6.8.
An attacker who already possesses valid device enrollment credentials can exploit the condition over the network to obtain unauthorized tunnel connectivity to protected services. Successful exploitation requires user interaction and high attack complexity, after which the attacker can reach resources that policy should have blocked while still being unable to perform authenticated actions within those services.
The official advisory published by Ivanti at https://forums.ivanti.com/s/article/CVE-2023-39338 addresses the issue and supplies remediation guidance for affected Sentry deployments. Exploitation probability remains low and unchanged, with both current and peak EPSS values at 0.0519.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43069
Vulnerability details
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the…
more
service, it just provides the tunnel access.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Procedures support proper permission assignment for critical resources through documented controls.
Attribute management for resources provides a mechanism to assign and maintain correct permissions based on security labels.
Prevents overly permissive assignments to critical resources by limiting to task needs.
Training policy covers correct permission assignment, reducing the ability to exploit incorrect permission assignments for critical resources.
Training on permission management reduces incorrect permission assignments for critical resources.
Audit logs and logging tools are critical resources whose protection requires correct permission assignments to block unauthorized actions.
Assessments review permission assignments on critical resources to confirm correctness, mitigating exploitation via incorrect permissions.
Certification includes checking that permissions on critical resources are correctly assigned.