CVE-2021-3540

Опубликовано: 22 июл. 2021

Источник: nvd

CVSS3: 6.5

CVSS3: 7.2

CVSS2: 9

EPSS Низкий

Описание

By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.

Ссылки

https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/
Exploit
Third Party Advisory
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ivanti:mobileiron:*:*:*:*:*:*:*:*

Версия до 10.7.0.1-9 (включая)

cpe:2.3:a:ivanti:mobileiron:*:*:*:*:*:*:*:*

Версия от 11.0.0.0 (включая) до 11.1.0.0 (исключая)

EPSS

Процентиль: 84%

0.02201

Низкий

6.5 Medium

CVSS3

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-88

Связанные уязвимости

GHSA-32qj-4pcr-vqhp

github

больше 3 лет назад

By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.

EPSS

Процентиль: 84%

0.02201

Низкий

6.5 Medium

CVSS3

7.2 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-88