CVE-2020-15507

An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system via unspecified vectors...

MobileIron Core 10.3.0.x < 10.3.0.4-19 / 10.4.0.x < 10.4.0.4-22 / 10.5.1.1 < 10.5.1.1-22 / 10.5.2.1 < 10.5.2.1-14 / 10.6.0.1 < 10.6.0.1-19 / 10.7.0.0 < 10.7.0.0-28

According to its self-reported version number, the installation of MobileIron Core on the remote host is affected by multiple vulnerabilities: - A remote command execution vulnerability exists in MobileIron Core and Connector versions 10.6 and earlier, and Sentry versions 9.8 and earlier. An...

QIWI: MobileIron Unauthenticated RCE on mdm.qiwi.com with WAF bypass

Last week, details about 3 CVEs affecting MobileIron MDM product were disclosed. When combined, an attacker can achieve unauthenticated remote code execution with arbitrary Java deserialization vector : - CVE-2020-15505 - Remote Code Execution - CVE-2020-15506 - Authentication Bypass -...

CVE-2020-15507

CVE-2020-15507 describes an arbitrary file reading vulnerability in MobileIron Core, affecting versions 10.3.0.3 and earlier, 10.4.x, 10.5.x, and 10.6.0.0, that allows a remote attacker to read files on the system via unspecified vectors. The Red Hat/NVD entries and related advisories confirm thi...