7.5

CVE-2021-22003

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and password complexity for the target account.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
VMware ≫ Identity Manager Version 3.3.2
   Linux ≫ Linux Kernel Version -
VMware ≫ Identity Manager Version 3.3.3
   Linux ≫ Linux Kernel Version -
VMware ≫ Identity Manager Version 3.3.4
   Linux ≫ Linux Kernel Version -
VMware ≫ Identity Manager Version 3.3.5
   Linux ≫ Linux Kernel Version -
VMware ≫ Workspace One Access Version 20.01
   Linux ≫ Linux Kernel Version -
VMware ≫ Workspace One Access Version 20.10
   Linux ≫ Linux Kernel Version -
VMware ≫ Workspace One Access Version 20.10.01
   Linux ≫ Linux Kernel Version -
VMware ≫ Cloud Foundation Version 4.0
VMware ≫ Cloud Foundation Version 4.0.1
VMware ≫ Cloud Foundation Version 4.1
VMware ≫ Cloud Foundation Version 4.1.0.1
VMware ≫ Cloud Foundation Version 4.2.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.99% 0.581
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-307 Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

https://www.vmware.com/security/advisories/VMSA-2021-0016.html
Patch
Vendor Advisory