CVE-2023-20886

2023-10-3120:44:50

CWE-601

vmware

www.cve.org

vmware

workspace one

uem

open redirect

vulnerability

saml response

malicious actor

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

Percentile

14.2%

JSON

VMware Workspace ONE UEM console contains an open redirect vulnerability.

A malicious actor may be able to redirect a victim to an attacker and retrieve their SAML response to login as the victim user.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "VMware Workspace ONE UEM Console",
    "vendor": "n/a",
    "versions": [
      {
        "status": "unaffected",
        "version": "Workspace ONE UEM 23.6.0.0"
      },
      {
        "status": "affected",
        "version": "Workspace ONE UEM 23.2.0.0"
      },
      {
        "status": "affected",
        "version": "Workspace ONE UEM 22.12.0.0"
      },
      {
        "status": "affected",
        "version": "Workspace ONE UEM 22.9.0.0"
      },
      {
        "status": "affected",
        "version": "Workspace ONE UEM 22.6.0.0"
      },
      {
        "status": "affected",
        "version": "Workspace ONE UEM 22.3.0.0"
      }
    ]
  }
]