CVE-2021-3540 - Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection

Back Back to CVE browser

HIGH

Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection

Published Jul 22, 2021

7.2

HIGH

CVSS 3.1

EPSS 3.31%

Description

By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.

Affected products

Vendor Ivanti Product MobileIron Core Default
unknown
Affected
- 10.7.0.1-9
- 11.0.0.1-3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Ivanti	MobileIron Core	unknown	Affected 10.7.0.1-9 11.0.0.1-3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-88

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26851
Advisory
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-26851		Advisory
https://www.rapid7.com/blog/post/2021/06/02/untitled-cve-2021-3198-and-cve-2021-3540-mobileiron-shell-escape-privilege-escalation-vulnerabilities/		x_refsource_MISCExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner rapid7

Published Jul 22, 2021

Updated Sep 17, 2024

Reserved May 6, 2021

Link CVE-2021-3540

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2021-3540

Red Hat

No data

ENISA EUVD

Assigner rapid7

Published Jul 22, 2021

Updated Sep 17, 2024

Link EUVD-2021-26851

GitHub

No data