VMware AirWatch Console and Launcher for Android updates resolve multiple vulnerabilities.

a. VMware AirWatch Console stored XSS vulnerability

VMware AirWatch Console contains a vulnerability that could allow an authenticated AWC user to add a malicious URL to an enrolled device’s ‘Links’ page. Successful exploitation of this issue could result in an unsuspecting AWC user being redirected to a malicious URL.

VMware would like to thank Nicodemo Gawronski for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4930 to this issue.

Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.