CVE-2021-22153

Published: May 13, 2021Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.3 / Impact: 5.9

Source: NVD

Description

A Remote Code Execution vulnerability in the Management Console component of BlackBerry UEM version(s) 12.13.1 QF2 and earlier and 12.12.1a QF6 and earlier could allow an attacker to potentially cause the spreadsheet application to run commands on the victim’s local machine with the authority of the user.

Affected (11)

Products: Blackberry: Unified Endpoint Management

Blackberry

1 product

Unified Endpoint Management

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Blackberry Unified Endpoint Management	Up to 12.12.0
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_1
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_2
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_3
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_4
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_5
Blackberry Unified Endpoint Management	Version 12.12.1a quick_fix_6
Blackberry Unified Endpoint Management	Version 12.13.0
Blackberry Unified Endpoint Management	Version 12.13.0 mr1
Blackberry Unified Endpoint Management	Version 12.13.1 quick_fix_1
Blackberry Unified Endpoint Management	Version 12.13.1 quick_fix_2

Related CWEs

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (2)

https://support.blackberry.com/kb/articleDetail?articleNumber=000078971

Source: secure@blackberry.com

Vendor Advisory

https://support.blackberry.com/kb/articleDetail?articleNumber=000078971

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.