9.1

CVE-2020-4006

Warning

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

Data is provided by the National Vulnerability Database (NVD)
VMware ≫ Identity Manager Version3.3.1
   Linux ≫ Linux Kernel Version-
VMware ≫ Identity Manager Version3.3.2
   Linux ≫ Linux Kernel Version-
VMware ≫ Identity Manager Version3.3.3
   Linux ≫ Linux Kernel Version-
VMware ≫ Identity Manager Connector Version3.3.1
   Linux ≫ Linux Kernel Version-
VMware ≫ Identity Manager Connector Version3.3.2
   Linux ≫ Linux Kernel Version-
VMware ≫ One Access Version20.01
   Linux ≫ Linux Kernel Version-
VMware ≫ One Access Version20.10
   Linux ≫ Linux Kernel Version-
VMware ≫ Identity Manager Connector Version3.3.1
   Microsoft ≫ Windows Version-
VMware ≫ Identity Manager Connector Version3.3.2
   Microsoft ≫ Windows Version-
VMware ≫ Identity Manager Connector Version3.3.3
   Microsoft ≫ Windows Version-
VMware ≫ Cloud Foundation Version4.0
VMware ≫ Cloud Foundation Version4.0.1
VMware ≫ Vrealize Suite Lifecycle Manager Version >= 8.0 <= 8.2

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Multiple VMware Products Command Injection Vulnerability

Vulnerability

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 15.59% 0.944
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.kb.cert.org/vuls/id/724367
Third Party Advisory
US Government Resource