CVE-2020-15505
CriticalActively exploited (CISA KEV)
Description
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Ivanti MobileIron Multiple Products
PublishedJul 7, 2020
First seenJul 7, 2020
Added to KEVNov 3, 2021
Weakness typeCWE-706CWE-706
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: May 3, 2022Update
- mobileiron core10.3.0.4, 10.4.0.4, 10.5.1.1, 10.5.2.1, 10.6.0.1 or later
- mobileiron enterprise_connector10.3.0.4, 10.4.0.4, 10.5.1.1, 10.5.2.1, 10.6.0.1 or later
- mobileiron monitor_and_reporting_database2.0.0.2 or later
- mobileiron sentry9.7.3, 9.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mobileiron core | v < 10.3.0.4, 10.4.0.0 ≤ v < 10.4.0.4, 10.5.1.0 ≤ v < 10.5.1.1, 10.5.2.0 ≤ v < 10.5.2.1, 10.6.0.0 ≤ v < 10.6.0.1 | 10.3.0.4, 10.4.0.4, 10.5.1.1, 10.5.2.1, 10.6.0.1 |
| mobileiron enterprise_connector | v < 10.3.0.4, 10.4.0.0 ≤ v < 10.4.0.4, 10.5.1.0 ≤ v < 10.5.1.1, 10.5.2.0 ≤ v < 10.5.2.1, 10.6.0.0 ≤ v < 10.6.0.1 | 10.3.0.4, 10.4.0.4, 10.5.1.1, 10.5.2.1, 10.6.0.1 |
| mobileiron monitor_and_reporting_database | v < 2.0.0.2 | 2.0.0.2 |
| mobileiron sentry | 9.7.0 ≤ v < 9.7.3, 9.8.0 ≤ v < 9.8.1 | 9.7.3, 9.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.