Medium severity · published May 13, 2021
CVE-2021-22154
An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
An Information Disclosure vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially gain access to a victim's web history.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
Unified Endpoint Management · Blackberry
through 12.12.0; 12.12.1a; 12.12.1a; 12.12.1a; 12.12.1a; 12.12.1a; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-22154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-22154
Vendor Advisory
https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
More from Unified Endpoint Management
7.5
CVE-2019-8999
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any…
7.3
CVE-2021-22153
A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker…
5.5
CVE-2021-22152
A Denial of Service due to Improper Input Validation vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and…