Description Preview
Overview
The vulnerability exists in the Management Console component of BlackBerry UEM, which is an enterprise mobility management solution that provides organizations with a unified console for managing devices. The information disclosure issue could allow attackers to view web browsing history data that should be protected. This type of vulnerability is concerning as it could reveal sensitive information about user activities, potentially exposing business-related browsing or research that might be confidential. The affected versions include BlackBerry UEM 12.13.1 QF2 and earlier, as well as 12.12.1a QF6 and earlier.
Remediation
Organizations using affected versions of BlackBerry UEM should upgrade to the latest version that contains fixes for this vulnerability. BlackBerry has released patches to address this issue. Specifically:
- For users on version 12.13.x: Upgrade to version 12.13.1 QF3 or later
- For users on version 12.12.x: Upgrade to version 12.12.1a QF7 or later
Until the upgrade can be completed, organizations should consider implementing additional security controls to limit access to the Management Console, such as network segmentation, IP restrictions, and ensuring that all users have appropriate access permissions.
References
- BlackBerry Security Advisory: https://support.blackberry.com/kb/articleDetail?articleNumber=000078971
- CVE Details: CVE-2021-22154
- BlackBerry UEM Documentation: https://www.blackberry.com/us/en/products/blackberry-uem
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
