CVE-2021-22153 : A Remote Code Execution vulnerability in the Management Console component of Bla

A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user.

Published 2021-05-13 11:15:08

Updated 2021-05-21 18:13:51

Source BlackBerry

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2021-22153

Blackberry » Unified Endpoint Management
Versions up to, including, (<=) 12.12.0
cpe:2.3:a:blackberry:unified_endpoint_management:*:*:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 1
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_1:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 2
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_2:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 3
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_3:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 4
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_4:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 5
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_5:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.12.1a Update Quick Fix 6
cpe:2.3:a:blackberry:unified_endpoint_management:12.12.1a:quick_fix_6:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.13.0
cpe:2.3:a:blackberry:unified_endpoint_management:12.13.0:-:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.13.0 Update MR1
cpe:2.3:a:blackberry:unified_endpoint_management:12.13.0:mr1:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.13.1 Update Quick Fix 1
cpe:2.3:a:blackberry:unified_endpoint_management:12.13.1:quick_fix_1:*:*:*:*:*:*
Matching versions
Blackberry » Unified Endpoint Management » Version: 12.13.1 Update Quick Fix 2
cpe:2.3:a:blackberry:unified_endpoint_management:12.13.1:quick_fix_2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-22153

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 38 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-22153

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.0	MEDIUM	AV:N/AC:M/Au:S/C:P/I:P/A:P	6.8	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.3	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	1.3	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-22153

CWE-1236 Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-22153

https://support.blackberry.com/kb/articleDetail?articleNumber=000078971

BSRT-2021-002 Vulnerabilities in the Management Console Impact BlackBerry UEM
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-22153

Products affected by CVE-2021-22153

Exploit prediction scoring system (EPSS) score for CVE-2021-22153

CVSS scores for CVE-2021-22153

CWE ids for CVE-2021-22153

References for CVE-2021-22153