Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2021-3198

Ivanti MobileIron Core clish Restricted Shell Escape via OS Command Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
rapid7

Description

By abusing the 'install rpm url' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ivanti MobileIron Core

  • 10.7.0.1-9 to ≤ 10.7.0.1-9affected
  • 11.0.0.1-3 to ≤ 11.0.0.1-3affected

References