Multiple VMware Products Command Injection Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.1 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

12.83 %

Predictive Probability

Percentile Rank

94.0 th

Documented as more likely to be exploited than 94.0% of known CVEs.

Detection Date

Nov 03, 2021

Remediation Due

May 03, 2022

CISA Catalog Active

Threat Analysis

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute commands with unrestricted privileges on the underlying operating system.

Remediation Directive

Apply updates per vendor instructions.

External Intelligence

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2020-4006