CVE-2020-4006

🗓️ 23 Nov 2020 21:22:40Reported by vmwareType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1287 Views

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector command injection vulnerability CVE-2020-400

Reporter	Title	Published	Views	Family All 41
ICS	Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure	1 Mar 202212:00	–	ics
ATTACKERKB	CVE-2020-4006	23 Nov 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, and administration consoles like VMware Identity Manager and VMware Workspace One Access, arises due to insufficient validation of arguments passed to commands. This allows attackers to execute arbitrary commands.	26 Nov 202000:00	–	bdu_fstec
Circl	CVE-2020-4006	24 Nov 202000:46	–	circl
CISA KEV Catalog	Multiple VMware Products Command Injection Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	NSA Releases Advisory on Russian State-Sponsored Malicious Cyber Actors Exploiting CVE-2020-4006	7 Dec 202000:00	–	cisa
CISA	VMware Releases Workarounds for CVE-2020-4006	23 Nov 202000:00	–	cisa
CISA	VMware Releases Security Updates to Address CVE-2020-4006	3 Dec 202000:00	–	cisa
CISA	NSA-CISA-FBI Joint Advisory on Russian SVR Targeting U.S. and Allied Networks	15 Apr 202100:00	–	cisa
CNNVD	Vmware Workspace One Command Injection Vulnerability	23 Nov 202000:00	–	cnnvd

NVD

Node

vmware identity_managerMatch3.3.1

vmware identity_managerMatch3.3.2

vmware identity_managerMatch3.3.3

vmware identity_manager_connectorMatch3.3.1

vmware identity_manager_connectorMatch3.3.2

vmware one_accessMatch20.01

vmware one_accessMatch20.10

AND

linux linux_kernelMatch-

Node

vmware identity_manager_connectorMatch3.3.1

vmware identity_manager_connectorMatch3.3.2

vmware identity_manager_connectorMatch3.3.3

AND

microsoft windowsMatch-

Node

vmware cloud_foundationMatch4.0

vmware cloud_foundationMatch4.0.1

vmware vrealize_suite_lifecycle_managerRange8.0–8.2

[
  {
    "product": "VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Multiple"
      }
    ]
  }
]

Source	Link
vmware	www.vmware.com/security/advisories/VMSA-2020-0027.html
kb	www.kb.cert.org/vuls/id/724367
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

17 Jun 2026 03:19Current

9.4High risk

Vulners AI Score9.4

CVSS 29

CVSS 3.19.1

EPSS0.23771

SSVC