CVE-2014-1409

MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
aka Blind XPath Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
mobileironvirtual_smartphone_platform
𝑥
< 5.9.1
mobileironsentry
𝑥
< 5.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://seclists.org/fulldisclosure/2014/Apr/21
https://exchange.xforce.ibmcloud.com/vulnerabilities/92351
https://packetstormsecurity.com/files/cve/CVE-2014-1409
http://seclists.org/fulldisclosure/2014/Apr/21
https://exchange.xforce.ibmcloud.com/vulnerabilities/92351
https://packetstormsecurity.com/files/cve/CVE-2014-1409