CVEvulnerability
CVE-2021-3540
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-07-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-88
Description
By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
Affected configurations
• ivanti mobileiron (<= 10.7.0.1-9)
• ivanti mobileiron (>= 11.0.0.0 < 11.1.0.0)
Related
Weakness · CWE (1)
- CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness
References
- https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ Exploit, Third Party Advisory
- https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/ Exploit, Third Party Advisory