CVE-2020-15505: Ivanti MobileIron Multiple Products Remote Code Execution Vulnerability
A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.
Other sources
Ivanti MobileIron's Core & Connector, Sentry, and Monitor and Reporting Database (RDB) products contain an unspecified vulnerability that allows for remote code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-15505?
CVE-2020-15505 is a remote code execution vulnerability in MobileIron Core & Connector, Sentry, and Monitor and Reporting Database (RDB).
What products are affected by CVE-2020-15505?
MobileIron Core, Mobileiron Sentry, MobileIron Enterprise Connector, and Monitor and Reporting Database (RDB) are affected by CVE-2020-15505.
What is the severity of CVE-2020-15505?
The severity of CVE-2020-15505 is critical with a severity value of 9.8.
How does CVE-2020-15505 work?
CVE-2020-15505 allows remote attackers to execute arbitrary code via a hessian-based Java deserialization vulnerability.
How can I fix CVE-2020-15505?
To fix CVE-2020-15505, it is recommended to update to the patched versions provided by MobileIron.