VMware Workspace ONE Access and related components are vulnerable to command injection

Overview

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker to execute commands with unrestricted privileges on the underlying operating system.

Description

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker with access to the administrative configurator on port 8443 and a valid password to execute commands with unrestricted privileges on the underlying operating system. For additional details, please see VMSA-2020-0027 and CVE-2020-4006.

Impact

This could allow a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account to execute commands with unrestricted privileges on the underlying operating system.

Active exploitation of this vulnerability has been reported.

Solution

VMware has released updates as described in VMSA-2020-0027.

Workarounds

VMware has documented workarounds in VMSA-2020-0027.

Acknowledgements

Thanks to VMware for coordinating this vulnerability.

This document was written by Madison Oliver.

Vendor Information

724367

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

VMware __ Affected

Updated: 2020-11-23 CVE-2020-4006	Affected

Vendor Statement

We have not received a statement from the vendor.

References

• <https://www.vmware.com/security/advisories/VMSA-2020-0027.html&gt;

References

• <https://media.defense.gov/2020/Dec/07/2002547071/-1/-1/0/CSA_VMWARE ACCESS_U_OO_195076_20.PDF&gt;
• <https://www.vmware.com/security/advisories/VMSA-2020-0027.html&gt;
• <https://www.vmware.com/products/workspace-one.html&gt;

Other Information

CVE IDs:	CVE-2020-4006
Date Public:	2020-11-23 Date First Published: