By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
References
Link | Resource |
---|---|
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2021-07-22 19:15
Updated : 2024-02-28 18:28
NVD link : CVE-2021-3198
Mitre link : CVE-2021-3198
CVE.ORG link : CVE-2021-3198
JSON object : View
Products Affected
ivanti
- mobileiron
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')