By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
References
Link | Resource |
---|---|
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ | Exploit Third Party Advisory |
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:21
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 6.5 |
References | () https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ - Exploit, Third Party Advisory |
Information
Published : 2021-07-22 19:15
Updated : 2024-11-21 06:21
NVD link : CVE-2021-3198
Mitre link : CVE-2021-3198
CVE.ORG link : CVE-2021-3198
JSON object : View
Products Affected
ivanti
- mobileiron
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')