MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-15505
• https://perchsecurity.com/perch-news/cve-spotlight-mobileiron-rce-cve-2020-15505/
• https://www.mobileiron.com/en/blog/mobileiron-security-updates-available
• http://packetstormsecurity.com/files/161097/MobileIron-MDM-Hessian-Based-Java-Deserialization-Remote-Code-Execution.html
• https://cwe.mitre.org/data/definitions/41.html