CVE-2021-3391
MEDIUMMobileIron Mobile@Work <2021-03-22 - Info Disclosure
Title source: llmDescription
MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message
References (3)
Core 3
Core References
Not Applicable x_refsource_misc
https://www.mobileiron.com/en/blog/mobileiron-security-updates-available
Technical Description, Third Party Advisory x_refsource_misc
https://www.optiv.com/explore-optiv-insights/source-zero/mobileiron-mdm-contains-static-key-allowing-account-enumeration
Scores
CVSS v3
5.3
EPSS
0.0036
EPSS Percentile
58.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Details
Status
published
Products (2)
mobileiron/mobile\@work
< 11.0.0.0.115r
mobileiron/mobile\@work
< 12.11.1
Published
Mar 29, 2021
Tracked Since
Feb 18, 2026