NetSight
IP …
critical9.8Known exploited

CVE-2020-15505

Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Impact

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

VendorProductAffected versions
MobileironCore
before 10.3.0.4
from 10.4.0.0 before 10.4.0.4
from 10.5.1.0 before 10.5.1.1
from 10.5.2.0 before 10.5.2.1
from 10.6.0.0 before 10.6.0.1
MobileironEnterprise Connector
before 10.3.0.4
from 10.4.0.0 before 10.4.0.4
from 10.5.1.0 before 10.5.1.1
from 10.5.2.0 before 10.5.2.1
from 10.6.0.0 before 10.6.0.1
MobileironMonitor And Reporting Database
before 2.0.0.2
MobileironSentry
from 9.7.0 before 9.7.3
from 9.8.0 before 9.8.1

Weakness classification

CWE-706

References