title: Ivanti MobileIron Core clish Restricted Shell Escape via Argument Injection
description: By abusing the 'install rpm info detail' command, an attacker can escape the restricted clish shell on affected versions of Ivanti MobileIron Core. This issue was fixed in version 11.1.0.0.
problem types: CWE-88 Argument Injection or Modification
affected:
{
product: MobileIron Core
vendor: Ivanti
versions:
lessThanOrEqual: 10.7.0.1-9, status: affected, version: 10.7.0.1-9, versionType: custom
lessThanOrEqual: 11.0.0.1-3, status: affected, version: 11.0.0.1-3, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]