Log in Start free

Actively exploited · Published Jul 7, 2020 · Assigned by mitre

CVE-2020-15505

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in MobileIron Multiple Products from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 99.7% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)99.7%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-706 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References